Analysis
-
max time kernel
119s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/04/2024, 10:21
Static task
static1
Behavioral task
behavioral1
Sample
076e167b9da09bb832b82be7d365526f_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
076e167b9da09bb832b82be7d365526f_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
076e167b9da09bb832b82be7d365526f_JaffaCakes118.html
-
Size
78KB
-
MD5
076e167b9da09bb832b82be7d365526f
-
SHA1
c357ad98ce3b3b2712e5db8f9c8ca7e03a456362
-
SHA256
01b579954c2f831c92b74269dc2758a0354ccd5f4d2cde495c8c97b79376ea22
-
SHA512
9676c04df51c615951232454f87267573effec57809fd3b1a0ccf5a8d4b2c683a030f877112b1ffe92e526812c0dcd3b48f5b7c416f379c90b2f933b02ae4b13
-
SSDEEP
1536:wabquklcMklc2klc7uG/bI+3zkcKklcPEijZeqhUEijZeqLyWfO02LvDEa7mE5XB:XklcMklc2klc7uG/bI+3zkcKklcPEijr
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420547961" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3D7B8D61-0612-11EF-8698-5E73522EB9B5} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2804 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2804 iexplore.exe 2804 iexplore.exe 2204 IEXPLORE.EXE 2204 IEXPLORE.EXE 2204 IEXPLORE.EXE 2204 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2804 wrote to memory of 2204 2804 iexplore.exe 28 PID 2804 wrote to memory of 2204 2804 iexplore.exe 28 PID 2804 wrote to memory of 2204 2804 iexplore.exe 28 PID 2804 wrote to memory of 2204 2804 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\076e167b9da09bb832b82be7d365526f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2204
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5a7745cbb566c998321f31006901ef5a8
SHA188c32567cebf6adb46cad4f703e38b9faf883e7f
SHA25674d05b10effcfa16da7e8b9c960089aba0441b43353e1590053fb01d223bec70
SHA5120b4e4f3dc1f5fe4b9d2d44a16bb97ce2e8060790d6b3395186b6260255464d5d9f235f3e5c85a3fd3a33315aee7607e0672ab1393c70c96bead748d1e850cece
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize724B
MD5ac89a852c2aaa3d389b2d2dd312ad367
SHA18f421dd6493c61dbda6b839e2debb7b50a20c930
SHA2560b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_52A940BB9460A4D8B06AFDEB9AFD2659
Filesize471B
MD5098821fdd3ef02d135cc396809f1b8b4
SHA11f577125b5b4381bae2eb768bdf0990d01f6ebaf
SHA2564674b63d23445330326f35f26a14bb2ee5779070b9fccac29a456d360e2d1a92
SHA5123cb0d1e3dcfa1601bf62308b76135bbb53ca768c5b18ca4adcd23a8db8012380240036ee40b4a28e4ba3b931bfc31ed9138366ecbaa38e220be4c0b690c56866
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD537ed49517674bc2350d3133340ca2ae8
SHA1dc827478c556133c93e7a15868b1810ea9336982
SHA2560dea39f30668bc91eb2a22f4484c9cc08383d5e0a610f04c129923e3eb3243a0
SHA512d8c3eacaf0beae0d4e202e04c14501b758f2ccb2ab6147dbf5f91baf9fde5a79a24b2f1a0ef984edb693e8ba2d49a03972c57e6d8e0906559566aaf70920720f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD520af575476bc60f15fcdb9c0fbceff1e
SHA10c43a1e843949d4b980775f70a2838cecbaa3d13
SHA25647a2bc65bef66d91bbae8d80568ba3b0f61e60a5df2995d4e994ec6a930e2178
SHA512f208142323961b26c3ce5e4bd58604da99162fa636b4ef386e7ef4b283735324d6f7b66272f05678cb607a310e5b9beeb2bca87c86350de1a1a08a1ed329c9bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51feb4826c016a526f9614ff4553c1446
SHA1898ebf5eafa15b25e8a5a5cfe7e200a20f7e9066
SHA256e1e4dadab805eb7bebd669d50a26515686d35ebed037a3fe82281903f0b576b1
SHA51296a1cb970008e750257d4f06101e33a308340847ca63e2d3462a5db3203213388e0eb9153942a2533d654e607ca28fc7d4ffd55ddf6d1c5dfc746c7e0cafee6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7489bd9b8cd70b7d666e7083fcdf935
SHA145b57fc0d812007cdd5d282075328a3ccaa7b88b
SHA256b070e95a899ce9244e581fa4c27886778601484bbc7048ef81a87fb00268fb92
SHA512b0462d98f9994b1176b5f112e9287538839fc9cc7a65499e160852356352757f74d0144209462b7a31d03836c4b3eae34bf0a66ac3aa44945d12c89e7553318b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eccd264a6396c974bd4c2057a1d2add6
SHA1afc8b1c0a5a858e71e115bd80116defc8a2ae7ac
SHA25680763c1f6157d56cb1fa7d9dcb5d355a8dc28abb44d91ba51537e42400a56cbb
SHA5128f9a9bf4bf18ea5244212ab5f2e6a2d616add6661143226dd497c1a9446f66a2d779cc01f18a00308c9fa8768258fbbdee5112805608015a6bde85114b160b98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfb358c0481df808345fd010df3e83d2
SHA1b5424c5b3cd59c1e63ed27825189b6837c6afe38
SHA256906492ef32788961af3155d55db78f23f59ef652dce1448cfec4f432696c2b87
SHA51249cafa987fae538730e30d66a6efdb564f28959f27cc045379d17bb573b71650be567e8b254d3d85eb59f09f2b555405a6a83e5883097052e75282b737985fae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54adf71ae727bc04e3ee6621dd9c31575
SHA17806d9d8df0031650d04458b9401bf6a1e78c167
SHA25658d12c56cb6c5e48ea1b1dc57683149e62c7e7c73a459dfeacf5fbafa89ad384
SHA512019541e84427212f3acecdb47c5a5232b3ccea37cd9d576a070a0478b865db4dcd97b45e26ce50423564c49bf9969376276714aba3566379ae27a8fb0c2a2d64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae1eb3fe4c43c708a49046266d0f66ba
SHA197dae8fd4d142928a03adb52eb011b5d2bf5b29a
SHA25683a1ab4a9cde0a9a2cc7e53ffaa48856801831a8603b36f9de11ed6739f171d0
SHA51261bee2cde315796df6f66565ef05dfcf8bf11d5f4b71e07ba3c7c9d5b9d757422a56b28f42924006b14c39b261244c4fbb46d2b801b84e4991c2e1656eb9364e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525077c3a1257bd56b60ff96cafe188d9
SHA143730d45bccafbdc5e84ee868bc31f26c6e9cc26
SHA25657a9a09b27937f1e1d34556c21e6ac689572e20105c0ce91fcb43fbaba90af53
SHA512f915797071f0c8c63c001c24408f116fbada4d1310daf97c26ada1fe0e5ca4401750baeb3f0855c125b86fcf22d492e070e20603fbd5802ebb582e7523ebd428
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c0d21ffe0f9c2ac5ee092e26907c2ad
SHA1b19547153e06d1b9a7d20d70bf921ee476358b5d
SHA256d5c509506e1e7cff65acc8d0b3e0d4303bb049b74902ffcda8a30d3ab52591b7
SHA512686b195bd64ec5ec8cbcaef5f0c19b79ff5669d4c6c9205df61c8d401b94370491460c0114732836858f3817226cc342a552efdea672ab066fea02e7cfe9309e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5310ff00296903391496f61a1e94324f5
SHA1b830857ee3b0f96913ba191a6efc4113ab43a3a1
SHA256adf88da2ac10a4ba193246e64c6f0908126fe0fdd27023cbced8a463232b071a
SHA512108761e1f37acf7f976416989df1efb552e4811757708ae1e15982570fa5fe2f81d05a28bb2505d2feace884db3075e140630c420b8407715df63acd6adb9c5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b42d9efb66e178bb374226a5c058b95a
SHA1c9cc806d8c2ba5572c1a55271d2b30cdfd4461f9
SHA256c6b985e3470344c86cb68f1a0c35c0824b0eec989d528028da9a714d0cade482
SHA5120e5e7f74f6d303c724a2a52dc50980a018b4e202deebbba4caac730964903b06b1bc42eb1bf8ac44bd484571e5b406fff6c850413b0f3ed7322eadc2ae03bfb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e71e2d212928b5afdbadbddc218fed64
SHA1a05b8cd9b702857bbb5ccce6c511a637c15e8c90
SHA2563bec69d5278944f9bd879d2099b7ef95dae25c83930db1d345c1b2188873e8a5
SHA5124a0a535dbc4e4df23428fa5232038636d1bdf0715128165e6ea7b9cbef14fc175bc2d7eebccbda78e50f14784c94ce0d1f403183d08b34eeb6bb174d36ea3660
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD5d60e9f59246ca87937754dc8eab1d233
SHA13c866154a3a0c05e0170b3a34d7b0e949f61b4c9
SHA2560ee91b944c75cbc75831f50a932bfad84833c40bf221c2dad6df95fa141b1e68
SHA5120ab2f03c628e1615e9587775772d8a20286af6648a57e37c293c3a2be03235baa1e236792e1eab924e91146102dc1c69402daff05325244e23abfb90d437324f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5fa94dc14f7e68a0b2c8c9de07620bbca
SHA1e972457670061c5107a8d5df5745917750f5b574
SHA2563addf6f35fd51a605b63ca537368fd1935a53d19bd3fd03664f130806771dbd3
SHA5126158d0dac83c8adcfdc10ebc7ace7b1d0a43b27b2d4003d111e2ac6d78d90ea916969eefff8feb70ae049624b48d71f830898ce0e443dac9c98d4d47c169e43e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_52A940BB9460A4D8B06AFDEB9AFD2659
Filesize406B
MD575d8c7e92f57a6eb6874eb5940f5e614
SHA1640c33ac9ec1dafd90373660e457597f1ba456b6
SHA256c82e9351d91f0c7d5f5b8b1736f8c0d5e08df7e8e2d0dcf28c616bc4f2cd3e0f
SHA512c5a0094cbfb78e0664067dea08c8999afc9de92f22e25b6f9dae35331bd6e2cc9c5a1516cd4caaac1e6f649a21f291cc49025a3f4368b82fa3bdf6bca5c9ddc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_52A940BB9460A4D8B06AFDEB9AFD2659
Filesize406B
MD5caa66c810665fbaf5959f3bf9c46de48
SHA1d88bf792b46b5712a82da81d4f27271240b2ed15
SHA256e92e8cedc2e3f2b6001b91a9aadce442bad987b918ce41418829e54dec8e578a
SHA5123e18981f18057051987256f84ab73a43d4ddb05f31402422196c23b4213d7cfcd06a580e4905945d3332cae8863867c9aa8aa24d6dc2cc17bca0638353e81da1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a