Analysis
-
max time kernel
118s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23-07-2024 14:27
Static task
static1
Behavioral task
behavioral1
Sample
67f0025b5f267d87cc020ab34d8e37c4_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
67f0025b5f267d87cc020ab34d8e37c4_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
67f0025b5f267d87cc020ab34d8e37c4_JaffaCakes118.html
-
Size
959B
-
MD5
67f0025b5f267d87cc020ab34d8e37c4
-
SHA1
b2e683307881cb1e97c1fe7dd9a93b4fee511511
-
SHA256
c857ec3170d21f1dd9c0f4b422b28adeb38ba180f0f64e874b8b3ea2bbcadd74
-
SHA512
7993b0c2587580db469c0aef7ef50382be7483184784fded1b1cd22166ccb96d6bed19f45b9fa13af12bbda27058c6c892a2e1d705898f2cdeb743ce6768fee6
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AA624511-48FF-11EF-9FC9-7AEB201C29E3} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9046a1800cddda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000de456b82dce6b6111c483391f2b3c2a53c8f4214877fd02c6c7bffaceed4f338000000000e8000000002000020000000d4f9f6ee8e08edbe7524589d26b2e19c2fb96f7290cb18fa8ce51da8de0cfcca200000008c0aa0b33496611083d41f3abbd7a28e92bde36c8de08161f8c72f9ace256d3040000000422db19c2a58839e65653ead7db3c9f8c1c89a1d24c6d141b53a0aff1719a098256d29ca1f280dc9fb7c3a1180bf87c65116c8a4cd01fa0f1655917c4045d6d0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000004a92694d20b5cfa3db0efa240cf43626272cf2c102c49c95976c968f350918e1000000000e80000000020000200000001f76102b6b734244ef60dabcfb4c22a699e30a0bb427652fafa4e9cb0179a7a790000000f3840d2e8cd183c6d0126121ae6c37533138fe0e4d606fe818b9256bae1ad6e9fb8bddede1980656bd2c3c744c549566c9e453fd5041bb3e32551ba433b9bb538d0751db14e25e883f46721e265869ba1e95abdcc4b6873cedf4f625f2f95bb484750a0916347d492c1935ab40d9a9c68901fbb49f398688e90718a8f53d54a801537334fbb7957a90fd4b28bb464a5c400000005ac2d030f11e1513d3d219c85be396ded3b95a8e881f1a01b44836b40f1f56e5a8dfb1ae1cb54ad1cbef5df34bf5f6e21516c09c9ac23d5a9dc65c33d3d5c2aa iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427906707" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1672 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1672 iexplore.exe 1672 iexplore.exe 2156 IEXPLORE.EXE 2156 IEXPLORE.EXE 2156 IEXPLORE.EXE 2156 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1672 wrote to memory of 2156 1672 iexplore.exe 30 PID 1672 wrote to memory of 2156 1672 iexplore.exe 30 PID 1672 wrote to memory of 2156 1672 iexplore.exe 30 PID 1672 wrote to memory of 2156 1672 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\67f0025b5f267d87cc020ab34d8e37c4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1672 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2156
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab36e4d0e50671fece3d4453e5604f91
SHA1ea9486217f89f63c19613b5545156baf7dcbc893
SHA256978d90acf1594f4ff59c446218464d672f00477277cd8db26c80ed0354abf257
SHA51248cd7e11eb5b14382a7a9b7de474391aac564b33bdbc4059c4eecf6915acd4721da038b3b7b759874903191d5ae73ec58fed54a388ee4cd75e84a71b6f124591
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566bb23efc8096ba452cb2c741d6cd79f
SHA1d97eb720e9a45311fbc8295f3a6323f403d7332f
SHA256730e2158e5d5b00d6132bff57af5a71f85fd896cac3ee33af3baad4bd21ad86c
SHA512b47ad8b18d98b4c4bf5998131951b915accabec60fa85c75c326b74913bf6e2af3529619a7248c93128372ce877ad078e870895fca4d292bd39d03ca2097da8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8e6a3955ac4f90ed65c1bb65d25c768
SHA184e8a907172c628a1537d6a64b2946b4ace5b36d
SHA2566eb19fc7830450e752c4d3e5fb19e3429c14c8ff208386af778ea6d3dd735f5a
SHA5124ddc3a6a01eb33e65814c56e3de72379d0eaca2f3e7aa6bc10d5c2641ff3df9f93a0521be8bfdda444e0e4a40eac2c5d63b0e235ad8384d597cb6280d6a40482
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5762a6e6cf372f823e0fc54c852883078
SHA115714cdc2fef5c7948941f2832258a5aa6a1f19a
SHA256eebbe23125a58af15ff828254c775087a4a3557fba20610fb29f20850167afb6
SHA51224c500a70d8232155462dfaaf77f5724f889128e71adf7e92bd7f3748745d62c43afd361e7bf769d8630a034e7d966e97b8843d72e10582055bc3e361bdb0ef0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2be1eaa64bd38f226871098637254e1
SHA1002f02d94025f163cc67d8f3c10ef9f8f4b6d39b
SHA2567ee814e1bfe20f05fa5560a4e982d5ccc570901d425e9be68afe9feba88f0a72
SHA5120e19091c6127ca6fee62d2f0cc9426eda9301b7d97b7148d1ac95279ef55352a7cc9aa5c333d7451261c2fd2428e3a396be8f0e3991f2f81d63793b27ce2d7eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eec027350fbdbd34b626131e31806511
SHA10d1805e2a8ff3219df86cfe572d5bc4c794b29f8
SHA2564fbf2e41889dfba62a6d4f5034e4d2cad937632ed89952a56d392dd6f5e5c7b1
SHA51238b930292083e54807110b5169c4a8b89bc0c866c470e82c61c5810168e4b7c94939cad582049505068f86185fb33ef5f1ded1b428a25d927407357e61afa867
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574f84ac088f2009c0277a102a9c3bf51
SHA10756a51d55b28ad812808ad81f3b1064ba095e15
SHA2561614a9e01f3a9a7daf80e30fc559c3e1de42b4bda7de8c710c7dd2c6cfa871d5
SHA51297a0ca53dfa8d75b0b8a850ac9a3aac421b87ef655aa1f4afcc98ace2bc0568a52ed771a1c28ab3c1fafcc999f1feca3566d4f63c9885beb81c88fabe774fde4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f02d2c25a3d8b56c13bd06e7fe1cc60
SHA1cb97a21755dbe9b26f14a359d17aff9c643a96cd
SHA25648494d20c32671a5268b043b4c58bf62dac0389ce0db60e22b7e72605aa500e5
SHA512591bc810e07af7277701102a04dcba7e8341f90bb57a8eece7d4c936696a518c24c7b724745f9bb534da4c3c12496bc066a65c381782a287a6836e7e5b62e5dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54436fb025f3b43a315570655d72102c2
SHA15f98eaaf4a3c83082fdd8f01fae6701331237090
SHA256a40b1fa5d1a92590df0026770b1050c2fb2549fa8b8baaa7f7f72c1b17af4392
SHA5126430d09af4c48ba82c642e0ea4522a5d34f8cf9eec9455729f073a6611a7dd439ebde27a8111747add8e26d5b0522371456bd9c86bf1bcc88b48f19aa931c456
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582c618ad2d1944192e70043f613afbf5
SHA1c1e6e45b994a3958a695f7d16ab9c81f1efe5656
SHA2566fc515767c20e8c048bc9d4fcf7805f534c9730cea1337c0ec37d59dc58a823e
SHA5129df1c702e813838a5339957a43702c72254992479293d54265af2b991df04f7d57aaf84c3e8b188ea5fb133e24e1f571b890aa2d2615b9b3db00e8a0244c77bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5825874803ff66d20b2633e421f81d7c6
SHA1f7cfa8a6a90a5f1ce876b564ba18fb160d620527
SHA256916a1e4477d23e767fee8b2594b4ab42c079e8dea2ab9eedbff6f8ebcb836a4f
SHA5121f69dadc901100cf3cf7e1e8143ffc28d311b5b890c190e7f3482eca0bd44cf8904f5efbbc6057768e4d258539c094ffc8085ce9547f989be4d49c291fbe9b58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5377d5f2ba69e9880058759dc7982c791
SHA1f39ac5df02869cce2b6eadfc275b7ed5f863a20c
SHA25643b826e286ff47f8ebe9cc4b4e82615ce9cf01a3fbec768ec4cd3fbdafcd36f3
SHA5122e80f25aea82afbf37c8a3160c04930acdf53103399267c161bd43a711186bb04ced4eae4c930a75a207f4c5a8f0f642759d6371a9bdec604b83f1b456f59c43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553f42cf2f32d1f41e270a5bab6d71ff3
SHA1cf88bf129b19b72d9decc05d76b93f2e06f5ef72
SHA256745d5fd2168012ac64f97580310ac4e8754bf147d6ae0963c3c1af2eabda7b49
SHA51260f42c021fedeca062cdebe0580624eb6205fbad0883c8b7f3bdb6bba00bd79f68f99e20cd5f55222433d96f07f144b0a1098ba0c38ea9a048da5c9934f5eb13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534fc5c95b2b4607b7b795d9e65680156
SHA10fe3448d007b18f6369c8c25f96b3e046ba73d9a
SHA2566d43f5ce37833dfee5ce24aabc8218c97db4efd3223c954227c967bd40c3d8eb
SHA512110471b92d88a063f582211e4145525abdcd9bcebdb825aa555707335bb1a8d256674b73ab209a865289d8c0f893b9e6151d956a10317b59ca323e72e70bae0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52eec686cbb4ca4e0cd9d93fa1cb9c266
SHA1e5a8e62b2f108b30fddf30138762143d6e40a997
SHA256d2471a2070de2e11cf1bb407cd45ab6e7baffc47323654112a383054f4fcbbd4
SHA512be63184641dac86afb3addf8e7d5b41923333ed580a1b8af2f628c3149f98e039154186bca53de78d9e1fe3798102667408a2aeec224aa57c45b7acf92b53a04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547b9a77c4984096cafefa62aa09adda1
SHA16ff98c75133ca3161d211e7c4e1dd07f0a4ca502
SHA2567b9453de9b5b8a7a348938fd92c58335298f59feed3395de8ad92d1a30e83716
SHA5120f1caf9891e3287368bc074171a390fc4e493529f6c21b0970500886c971cc504d50f1ab16ba89e2cad3c675622cd973ee2075e39eb09c1e67e4937116018eea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a54c3ad141b811c1635ff12c2e91a20
SHA1865a20851d09a4761deb0fbf0b61b5e927e9ba64
SHA256ce87b23ae5b3dd7751a888c979a448a16ab909028add578d57617c5bcc47442d
SHA512414b321da1df4d4ff3dd16cd356b68eb047014962661a896f647eb3071f217a2a73f7bd23d57eae6b83d2af504a7fa736f7370e4a20a159740faed8d9718e86d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0102e673e57ea4b36c2f08b023cf42b
SHA10d9d2e6c15921634bdfde258048cfafe2396548e
SHA256cdce0ad57af6a68696681d244968f8f9600a5f197caf43aa10b194502408f00e
SHA512fecb58c6bc66f2833f6dd4bc70c0395b2b74defb521fd90629ba968d44f1233a7a13c7565ec0404fe2db49dc04f17ef7c1cf8ae3ae2f3612127e0a34cbe2f9d5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b