Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/04/2024, 10:39
Static task
static1
Behavioral task
behavioral1
Sample
f594954314da5099ad6d621ddd99c367_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f594954314da5099ad6d621ddd99c367_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
f594954314da5099ad6d621ddd99c367_JaffaCakes118.html
-
Size
28KB
-
MD5
f594954314da5099ad6d621ddd99c367
-
SHA1
7656d1002bf27c45f9ff68aff3c3550287be09ea
-
SHA256
f0c1f36eac7752371dcf97b5fa4171f69af19bc80a88b7e248ca3509da714d86
-
SHA512
c132ed3833814a6f1f36f38e103ac413d08b148cdeabdd63961c4bbedf1c72b13cc0de7984ee6a6355f2476c60d99f46001b51f80c6d1e477ad251588815b175
-
SSDEEP
384:SW5MKpv42JdvhjROv/kTDKOmmmqU9gLYCge3Ay5f:SW5MKpv4ZvMTGHmFwq3vt
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000cd039f5ef67efe26c7606645b5ae24fd25ec7b471416d5020967021bca5c2312000000000e800000000200002000000096c0478eb2234190b76bd97d516df5b5a0472e5a7effe2eb2b366b6baa598e4c20000000bc4910c6ae2e4ecc0121668ad9f57a4a59d2afc6f0c1282523216688cc6061a4400000006ed971bf5d43b9f328b1ce33b26a9e790e61141960214e2ce9ae915ba5404181dca70545a7d0550f706595ec5e4bf5712075a4b819226cffe0d2a2e9c3e229cd iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0165394b390da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419512218" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000007535635b94c6ccb4dccd0dfd24b9a56dcc60bc9bdc817ca1ead44a6a981600c0000000000e800000000200002000000030f1e2933458d03e5dd5a5b041a1638daafd66fba444b6e3fe906f9f553198a390000000b18304863fff9f1f89ab6a8d25f26c832b16ab8d3567338c40bbd8d4ee3b0567292647b2228d2846e89df7f4ff1e83a8f92c1f8cf5a4f3dafa3b49bedeae393704549eb6af06dbd27076a93f8cbad55c1d8eb01786f5813e351fff07b488caa945f1246c8e06a4646672741e2ff7c4a1b06d26a22f02b238529ef8df253082be5d5953b7c296ae8602b556db8b05326440000000ec985c31660a42fad7b491bffa49ce4950645f3f3990e86e073c91e4dc7f1a2725aca37a7d66a7beb88d32170e153c15b59a945d0cc16c39ea678aeb34756cea iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B900D411-FCA6-11EE-AFF6-E61A8C993A67} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2240 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2240 iexplore.exe 2240 iexplore.exe 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2252 2240 iexplore.exe 28 PID 2240 wrote to memory of 2252 2240 iexplore.exe 28 PID 2240 wrote to memory of 2252 2240 iexplore.exe 28 PID 2240 wrote to memory of 2252 2240 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f594954314da5099ad6d621ddd99c367_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2252
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5b8decbcc8b219a69e7ecba97ada8309e
SHA163e3faa736a0e7096e7bdcaaf5bf573e647e627e
SHA256f40cad069883676ed4d16c19949f535b3c32c2fd74105a989fc13b93bdcc19dd
SHA51216e96d8256845745089c4ea7daf1b24b5eca2f52bff7bdaf3e6f1abcd3fbe379fe87b1da8118d6e702956a3afdb9ec70ca29ece569f48c2526fc4416a74b501f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a022699df640352e348b65065d72a84e
SHA1f8030fd0989aeb6d440f511931c980ac682a3ae7
SHA256daa8e687bd02e58c3c1e2690d4c468726c103945b4afb0b869dd441ff5bc2e60
SHA51262a0f9ad9221506a1f15283676986715495497dd028d3be2658b56cba6da6ac09a3f0cad54c3a931ca2b22d3a2c7b365e9a11ab11a7cf005c57f871db65dbe3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5115125a9e5cbb8267cd717597a0da5da
SHA18aeaac2d14f63731927c7d9e99f48a7c12ae82f0
SHA25628d2ff84dc3dd3cd1159642a634bd90b832580380d00d56c709fad4d935eee46
SHA51234f75b6fb3322481d4aa1a12a7ca46cb2ae1ad04596ededdf8a18e8672f187414c2381f07754242c37174adcef9dad729be8d66063084626a7f7910a6388e326
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528c5a474f0919e205bdc7a94b61008f4
SHA1f638549d65f8bd844561eea12af65cfbfdde4b04
SHA25619070f195a05cdcbcf902833e0639b3b05494c39f53251cc941f10d85da1d1f2
SHA512f6ce9455b86974e69cfcf52b5d57e9204086e2182c9e8c7ffe0c424a645970c5eed4043e9300e614803e76909f5ef7d700f7e3d76b87af5b20b5b2b650c9b2e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587e6072b444cd1d106713f465fa71a65
SHA130db5d2b21f5d6236e9a5f767a6bef656429332f
SHA2560603f55693ec600bd36c6c94d0e37d4cd95d8f630af92bc9433a06ee3e553ae0
SHA512c440bb968c0ad9a3017e307b3b4728491d3b45805438e43c3d73e80201c0125daa0caee5ff9737f081b124edf69b86d9ca8b7aa0bfecaee654f356b7550119eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abe2f3eda4e54c46b2d5758146cb310d
SHA1e2897b2ded8293001e9aa99c84d2a49d899b3947
SHA2568c2fae1b2275d8a9a452fda709044e48b2c555d77c79d6ce411fa2a49812d969
SHA5124a1f7f8a22480dedceb1d116a8faab33c6867a52117c4a2eda6eb96104605bda13d6f59758cf5653ba9b8e4d102e9a7729aeef22935f9fe793b966162f1fba74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb02e48b014a221785b21d00d267feb3
SHA1647c527aaf03aed6bb52b2d664a98ac2de6b4a0a
SHA2560f46a701dc5ad1eef51ef12808ebc1ee49c7fd002b93d6717b221b4add266faf
SHA51233eae7814e6b2267714f68e092cc0503188b30040a9fcf9a9fb8d6e2b372aacd615cd31789162a235b5d6d0c863ad9b48e18fcab4f11d3a4be0c063e3026929c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581aa7ee4dc12415b05bcca79f658feef
SHA1afe3ec8632e75c9bc6940e100c5a238940dd4d33
SHA256d40e59962c8e48ca58b47b0fe4b1eed0d1566f0c5858d329cbd2a99b1a6cda19
SHA512a2a709777318714cf9cf46b349fabb29af704cc88e5cd81210abfd6ecd2005e364a4368f2ddc53d08e92a284ecbddeb2e4368a21662c88053996200b70a93991
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c575de6875764f8c766ec73781327f8
SHA1af5f1a6e6021144d9242a8d63134ce1aff8795ca
SHA2561c4393683df71615e6f67d00c5d95ad32efbb17ea971cc8db3454b18457e4fb2
SHA512284c87a773dc637de25d8e3ef8a9f501e313454f5ba0dc05323faa4ff8d4b37d5fea2f4ac6019880f5aba62f316a0089c735065c2c487fa5fd04fae56446f835
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c77c912c84f84d6a017190089084f91
SHA18319a464e7edf3f6b5f0124790d47c08ee5b1c57
SHA256a14b331be336f9152185af330c6cb56f47cfeec616b7fc59b41487c4e7a0a4e5
SHA512afc49881c6f067c77f29bd2c9ed15a51540731b604c3fea702ca57a9931b9e61d794f92f85aae554613ce4adfb6959c6fe470494b56b5f54d2317abf1b35aca0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5071cd7ba386396b2815a23a7bf16ebc1
SHA17149659f9c4579b56dc912fee6377bfcb686d602
SHA256376c5e58922f9fc56c0076c7ac66d4ebed3154c5f51c2b677fb72ba025e69732
SHA512199e091abd75347cd2ebecdfeff31f8d9bd5eef8ab2c377e6c8dc6166b6a7528bc847be3b7d643e3c0291e7d6d71835bcfc901cd023c4a37efe223d4ad2c9dac
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a