Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 17:34
Static task
static1
Behavioral task
behavioral1
Sample
05b6fb6a73aa4da9992b8ecb143a9d1f_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
05b6fb6a73aa4da9992b8ecb143a9d1f_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
05b6fb6a73aa4da9992b8ecb143a9d1f_JaffaCakes118.html
-
Size
461KB
-
MD5
05b6fb6a73aa4da9992b8ecb143a9d1f
-
SHA1
0d2d4b610dab8cfe6c92062ee6a0ee699d2f22b3
-
SHA256
496a0f1105e47f6d115e15087d1e543da1993521ec9e720d904f3e620d59dbe3
-
SHA512
a12c2550d3fc85e21d12ae145d13b6e65c599d161c754b250f4c734fc313a0eead254e7231b55f8ba928a279614d30545dfc3e641403cdc9adc7d5a67b2853f2
-
SSDEEP
6144:SxsMYod+X3oI+YDsMYod+X3oI+Y5sMYod+X3oI+YLsMYod+X3oI+YQ:I5d+X3p5d+X335d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420487528" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C3AE551-0585-11EF-BC03-E626464F593A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000009b30de90b68b3eb7afae61dcd254017e6924e33f3ef78d95b244614d79faaeee000000000e80000000020000200000009f3419541cfe7484bdcaf4eab7a0722f13351a868233251dab788334d588a3b1200000000b89ba831d03e0902c1fefb50eb6781f7d488ab6000c783718451cc74e35df804000000089a2537d33db7e5d34d76b747b570e8985690f4352c4b947c6d66de5e354db1aa2ff5abd236c54f153278a4a01bb59ed4c85981d3544e5ba7dd29373afb545fa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000087b0a0cd15c1e25942d2b76d9ac0863dac239813e354ef70435a824f9a746e87000000000e8000000002000020000000519d8e557e82faf0370723ffadf2a38abe639d6b32b2e068069879d5f58bf02790000000fb867f50fe424cac3ccaf37a5af03676d6d364b821a4b230616bfd6c9a1e53da8f78a396bd2ee361ea96105874735e0df37ef42f02f5c2834709ca946eee364dac12c8109f9db8b1c414b2a17d429bd8f52d9d8a30ee6cd95d7aa5598d88cfa35155b725894b573a23d2455507bf4a58fa9ab0f0f5cb71933f7a6e93d6929af2fcabdfe2c9ce8747965066e47d5d2d3e400000004b4f195060f934a19195e82ea25dcf3f74a4e495b9edf6929eace2dc42332fbf5878f1a9c85bdccc028479fac5c246d6adb3b64bda4d85a67332558a48da4200 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 404dc9649299da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1876 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1876 iexplore.exe 1876 iexplore.exe 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1876 wrote to memory of 2556 1876 iexplore.exe 28 PID 1876 wrote to memory of 2556 1876 iexplore.exe 28 PID 1876 wrote to memory of 2556 1876 iexplore.exe 28 PID 1876 wrote to memory of 2556 1876 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\05b6fb6a73aa4da9992b8ecb143a9d1f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2556
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf7e39c7426d8d204570507770065f18
SHA15e824baf090aabed63474e5e66c52789848e17af
SHA256c20cf53b960a2d0426df9b95c5c737fb28963e65854cb834a93d371e4b945ef1
SHA512f5d95f7930ff1d37e0a914f3ccdc969f54210aa3b8845663f674211bc0ce8dd36d3214a83a1922ab0ea60009165387a55a0e47464c1ef190c848a730037b1cd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549aab694f72e41bc3fa344d6f44c2866
SHA1702558123a2d2d64c7717148522c574dd5eb6f08
SHA256dd7882f62fc17921bea678bb0bf2cb404e998fc78a5d618e931f1d80ed698106
SHA51297f0b98cfe994ca4195223b48df6431dd9ce0f8a429d614954cef35c98cf3fa8ca9fe01dd502fb5d676b500a4c0b4a1652974f79f990f8588f0e012181111532
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579736418f4a96dfed2d59444c3e74278
SHA1082fb6419fa59cec88894b19d23137ba68473113
SHA256419308587b8e59d6456eb363c8e491ef21547be6614d464f6b96dd025075d140
SHA512ed6ba7d9b122e0196019e127d6dcbc00650e3186727f0e06dda7c846a24bdaf7f29e4bb5e514b9fb25d85e17ab6182f3b4fd9d9112375ff5e5f95e39c3ee05b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51cf52a482d0edccfa7dc80311ff44a94
SHA1a6d07f5c77ea9c5fa722370d8cc0d7522b21d924
SHA256ca918d1f27ac1c51e6bc59b45d7f82e5f6623d81234bf3fdfc73879431c69839
SHA5123488fe9dc9b52a43e1eeee81fd40bfec5995911e710000c78a48232490348110b2b419b07d8482b41c16de1f38a83a660fe994222c63d21ee8a64d26f5dce344
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a656cfe27cfa7349bcc3c50016108d5a
SHA1f4350628cdff882e13b024901300b7e27185c16a
SHA2562c37b5d2797c5df90f97bd8f459d7bb0527dfa33d8ca22046c5408cb3b8dc7e7
SHA512311da312ca0d24131b78f3aacc7957b8f21c6378d205c5543f17a21f97275123308969758f49b62df6999f99337292e897ced60794a79e2996a6d700a376edce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574f551f5dbc88f63e658aaa1492f7894
SHA1d6a33069867f0d313276e680cb80366af04faea8
SHA25639850ec2866f93c214f68d83c6b95bbb52258fea354cdb8437b78e03b26e1de1
SHA5123e117aa9316ad9fe9b298cc158d775aa95274de544b953fef4da2680dd936d05f71d66a9f18589ec7803a53cc2f0b5412954c761fbdc881eb561183fad685040
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e98e6f228435a39b873f17a3de8f0718
SHA12ba2df26f5fe104c179a484772d18b8f2afab982
SHA2564e4c9a81f2c6968d3ec22ca5f64b6f721d016b5f6a8d84aa72bcb9efe5777e34
SHA51257b750ccccda56543f2cff53922ef7d3cc00f578a36ca0821da15281f1463016777631bfb12d7684969be84ddb2e8ed60229e5d490fdd492ad33cd133282094f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53fb9902729d8a005cb41dc706b4c22dc
SHA1644311fdd38377f7a1b9cec6ceefc5e39b844b89
SHA256ffb45f9c1be4fac75a9a5ccbd5f9af8bdcd594a8d22c66609dfe32a098196092
SHA51236bac11e472e5da92f4c2ef0f647b3c9ab24dc0e01431117b20b32518789411ea270e7d79a3ebf409101714b8747c9c0ee8610903762e5319ac507f9db40f448
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542c4a035fca81b261044cf3ecd2c1d6c
SHA1bf00afdd86409fac1548932dac2824ee0ef5241d
SHA25684c1c014630d94cc02f36d99b01e694df23b44038015752b1533a0fa1888457a
SHA512654dbddec64b3acb2a07d75996f3ea1f3eaf1dbb97c2edb0a36e776ac25d51565519b0de7d924761b23dc9b757538d2c9638c66da111541b0765d8d7dee1e368
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5195bf2c85db04ddf4a8a30f6840604b3
SHA1710642aac0d0896524bf08ad41a95cc9b2651e78
SHA25660472847c8e78205b9e0dd75ce0085bd2dae75d46fc43fd6f790d318d10346d7
SHA512837df09e5258959312d0bc53df4fbbea05b484ddb0de9efadcd4e2feb91c094a6f0ff2cd3eef9a2e6b2bf539b7a584d05bd1add5f3beb07543b0797848cb11c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4a527129c84c26d1706b9f3b27fbb03
SHA130a6c29251c7631f6d3ceb78481397ce276e634d
SHA25609b20e8b85677e01915806f8b73405e1b14e8bd1eac3c07c5e7894e3471d39e5
SHA512a0da7021678ab01bac45c069ddd5cb3760d8749b6a16ab33d241d84fa42842af33e059a54b2330de6f4c62003eb40ddfaa09cbd67e06c0a4c6e61733f6707562
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508bd47ae268f637580e31915f2916d31
SHA16b9cd45ef1f7f498427c8c71c9281aaa297111f0
SHA2564c413beb34bb3c58a30757ff6fff92dada4f79f66eb710f123eb1b3bd15543ba
SHA512dfbe6fccf3be88ed6604a3b153e6b2c91e34b3ab5d69163461866175794de5d1a980f83e8c93cf78e812abaa93d9065ada097c17d0e506c80fdeb21ba4c7b05a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c8a9d1d0ebea43b8b2e15617a9973d7
SHA1b7b4c4f46a24bd681aa5ff15222dd503b710a87f
SHA2566d68399892b23658ca75681caba7beb39cf5d9a412f4754ea3997572073b16f8
SHA512d161583f007995242b5c14b6c58a0fe0367a1f76168dce4641c00ed2f7e351bbd4dc8e3cf52887c5462b1cb9cb27d06af989b67705f107f2095b210e7ef3abdf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d8331a28d43b9a260c2eb8074b65bbb
SHA10c2c9925570c8bd296aa88feb37523a66cccdb56
SHA2568b4e0468874dba0c86bcb86c2a66b8d6c630be705b2103100f74af337b6f7f19
SHA51296bb940b0236863c33354fedb81989013512b22d185635f73ffd5d55dee7fce935825349483e3b2f1054df5017a6403dd14fbe4516e40aa3aabd733e36183b53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c20e2e770a47781ffa6c27dcce8a3c6
SHA11387b696317dd7131003e858f26b870ac5f85e43
SHA256a3478e680aebc4b23c475a90174977719fb4f11d62ee83430081855fa94f2809
SHA512f4dbc8b51e729c232a5e3f00a96ef6cf49a433be7316a6032538f7500aede431136e64940849dbff82162d6386b92502e397e711f639f26e1f99d5ea770efc18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8e317c35547039df79906f1bdd7cf1c
SHA121d15e41d0036664c128de140b6e3ac521fe22bd
SHA256ad3fdb0f29217f5d9bf316e9fa16e1ec11c4e85542dd17162f80152765727e95
SHA512c8e287fc5b256162ad6989efd52c3f668095b73ccad1c1bea17181dab2ca9f09525f5be031ef228ecb899ec079d001f3eacb020f497263c7ba7cdab48ca32c78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5434fe3bdd93d93e0bc6fec012944e4fc
SHA1b7a4155e2f4c9589482eba060fc8dcd83f025622
SHA256800e8db6ceb454d73ce2a7bee317fc0b0c953fce388e2752d184de3360795ab7
SHA51233aa9c6b6c92094f2e4b3df1805a24bcb7184a2e079ab000611c40d2adc98b25445fb53685885056508970742316457174faff9169d04648d8f879bd6629b8ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a3514a15624806ca1ecb1e9725defe8
SHA1524c6a106774c5967de389d261d35523e1b8f670
SHA25612fd0eea1bb9b921460fe7d2d005dd059730f15eee525b01b78b3bc8558e6230
SHA512c0753d59b03ad11c7bc2e8c6c9f6c08f879e58ad3870491d71bdf06e6296050c7353401b481619e430e853f1d6bf7271a790b751651dcef31483d72107457e83
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a