Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 09:14
Static task
static1
Behavioral task
behavioral1
Sample
2025690776557bfa3c8817183ffc0afc_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2025690776557bfa3c8817183ffc0afc_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
2025690776557bfa3c8817183ffc0afc_JaffaCakes118.html
-
Size
42KB
-
MD5
2025690776557bfa3c8817183ffc0afc
-
SHA1
15b3e6b410bd189fb40a9a2ecc3d8a2f040493ed
-
SHA256
5aabb56b881a9a73ef7611abc7fb3e84cfbf1756304cdee950559eae321137e8
-
SHA512
acacefae0258d31da7d126d4b4a944117de13eab3a43c76f1aec85888e739b67961ff6aebba875796bdc232fa5b7133bdf54b7858484739452eed280f4c36247
-
SSDEEP
768:nvYI2kOeOJw+Vh5BPn2Y05kC+MPJTMGgAMULQOWVCgaB+NbjiQhydC:AIvgh5BPn2Y05kC+MPJTMGgAnQOWVCg5
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000606f1cf72ac9f430a6ac3f70d4b2a6b34bb8dd0c864d97a04df0c0d8d7321ce5000000000e80000000020000200000001ff2ea690e2e97a246d06731cf1087ab7569b4710cb1170935326d7f291e889a900000005f65ca5f96dddf661b6ecdcadd1b472f71d426d6f375118ab7777de99462ade5cc812931dc16cb59c481a3b1ff3afc8ee3aeae04bc3825ccf73d3211964a5ed47513bc15ea79cb2c61cd70a8880b04e6212e67cec3ed4b3c21b0585b51518f0da95c462899cd446bcab60cb5192cdb20d2bb2dc8a12f95dcbfd2815219a1ebebdcf2885c3595eae37394047446a9fa6540000000f4e3ded135e47235b21fc2ccd8592acb5caf566991e8be58bddf140fe130b2d7b71101c80553e55d726f4c52ac308a05c29e564d205fa5ad2145b628ca002379 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000022fbf36057946e6771e4c31964b6fa09a3098aa51bdb36099f75ecd5dfe9eb8000000000e800000000200002000000081e62ca55a09157aeaa1a30716a8865b17f43d2f2373e0a1ed807c2227f23cb020000000b8dbf25bb2631279b88ea1e5f5c784d473e674aca56b7b1a8b088bb90de20cd340000000ed1b70c90dd43de1e36f32d08167ece1671f47b998531100713abc8676b859cbd5d79797d47a463e0611d584789e860ea38b7a94e637300a11d6bab3bb69edf7 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60389b1d5fa0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421235170" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4889A2F1-0C52-11EF-9960-CAFA5A0A62FD} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1368 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1368 iexplore.exe 1368 iexplore.exe 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1368 wrote to memory of 2744 1368 iexplore.exe 28 PID 1368 wrote to memory of 2744 1368 iexplore.exe 28 PID 1368 wrote to memory of 2744 1368 iexplore.exe 28 PID 1368 wrote to memory of 2744 1368 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2025690776557bfa3c8817183ffc0afc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a690cd9150f27a9a89de05cf555a2a5a
SHA12b828e61fee114d06add3fa63e393345b6ee8a2d
SHA25631a5004d1975dba285ac7eab88ce1bf9cc31a43586944f07c8854e39177626a8
SHA512c59bb13720f5e65bc03e066a0789826fdbb70cac82debd90560d4c5f9d2156b5130e782c64addb48652c71c1486b9cbd912e308745ec43ed1c5cf7ece5b1e0b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6c2837f87792be01dfc6eec8260825c
SHA1467a91b1cfbb1bee784f737984a106fda4b1281e
SHA256f9eaaa786a905de8d7ed877119e52740e5736ce6fcd780cb94123f5112f05d87
SHA512bd6d14111369f99e2e82cc1f625b0a98bd7e3ea666e34c37f05d15f9b0ffbaa9bee8bcd08dfe71e702f9d0fc4cfeebb943c91bce214684dcacd5245735bef735
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511574721bc500b64381c3d082104f29c
SHA1c452b48ad1e7789c3f2223e5ef7dd18888cb540b
SHA25632881504d6806e51815a782ef27422e77447379e7a136a01c809f18e539e295b
SHA51252ebfb2b4f372e56b772351235e20ffd0d9def00ea772f54748554be5ed85d980b63beaf4ced139d2f7e5bcf46cc06d7adc8d75b54d5c3b3e86181304dab841f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590f3fec85b35f41fd5561cb10c0df0bc
SHA155fe6e585aa425fc53f717fe4e2c05a3d248841f
SHA256bf096b4c3607d9141200d2f173ca15033ed126fdfcf8621db80c95812c5f91b7
SHA512d34dccee2ea00af3ad49df3de30803086e244aff50b669d0f4a847df797e2e59765b67af321a5c11a099321cabbeab8b54f4abfd3deb650c66fea5cd8a12a727
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534e8696e59eb3595242c7705b34a97bf
SHA14f2c9d1da4ccacc38c39e24e861849c061925a6a
SHA256a152d4fa242bbb294d431c17118c1eaf632e87230c1cf6e1c38cf82c0fbfcf34
SHA51269c592839a7fd9999d51004e0adc0b7fe8c7a66a0ceecba4034561faa791862e9adc6f90f43d62ddbca6a7498e68236729158a1ad7734494ad3cd4f42813fb2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526b0b2b8300937976778a37aed79d8e3
SHA13ca5a6cf349ad083f614394cdea637f6ec334de1
SHA256a4d3ee7b027e7705a4baf384fde712b66810221153004dfd67c1aef58d3bcf99
SHA5121e1ec9787bc4f81c9e2d3f68f26382d2d6cf01c3fed09e6ceb5aeb9355b5ca8c45e5679b284d178abf1774b7a7219f75c53ab253b3dc73c93ff11185ea19990e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5afd5591d2e0838fb7fa45138ea13900a
SHA1517a7bedc74a671af451757b83ba0cfa1b5729f4
SHA256dc1c103a87d994d41b44f7eb5eea6de21cba8d65eb53fd3c464ece149b6bd340
SHA512f64d4aa200f12a846000343dd3ec55793a003dcfbd72b712604183231e646f82bd55ae518163df9500ca5780dbfd139bc697e7bd247791de8e3e85b342b395a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5638a3636560988eb8fcff097bce7c586
SHA1c2f5bc8a06959027e3174b9474dca622ae4d7fc2
SHA256d588dd74032aaefc2de72f24baee6d19a8d64c33775e8d8dee9e0319d85e67a7
SHA512d332dddc8ad42ae40ae8490b9cd90d779d9c29a592a2439b9d2705167cbd425eb1d8071b979e9d89ea01d98c3444128df299c9e9c9c7e2c5b6a4fc47c088280e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea4c99bf7ced4a249d2e6899871590a9
SHA19799251cb6654c37c727c0e675af3995741cf5d3
SHA2569a28794dbaf32376b97d4e02e4c39cbdf5ee143dc3275f39618bee9a46a87098
SHA5123c2f25285c12fe6f7449c2eeb5cd08c3f3b7b521928a2c202ad0b539689651252363d2c4c92602d99d3627e78fd77a9b9aa0448d6c2cda822f80ac7628bc082f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd3e8e135ae756a562fb0e4afdbf85a0
SHA14bd33e070d58704d02edcdcec8c7e0c3aa7965de
SHA25634740ff5495a58a532672cba69efa861970e56a8fa494dd8390154f621ed8179
SHA512fd6dcfb44e508c2313133db77d216757984208b139f29e435b34a6b3a6163625e07e164f16bd329fe09d139aead12b887562afebc633f5e61fd6e39fb8aab3a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517d96171b11466e78ba122f343731dfe
SHA10f0799ac28a8e481da6a098beaa524bf75b0dda5
SHA256af590c074efa5780894a0c84126a092525566795a53ca2525048835564e264d0
SHA5129a1a870f38cb8f9484f3ec8c483a7e133dc4a49fd8c32d0f736a5fc0fe199f3ab824829391f7f6167d33a3461a09ab0d5b5a4716e1b870e8e316d180b74156a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524f38328d13951cdcf97950fbb6b4582
SHA11e0e42402fbd2c18e76b54aff6bcb2842f87b475
SHA2566e3fddeb586627483a152753331e78124d5f13c68d19fdeadb1fee09f1dbcfcf
SHA51224d67e42b20e09c05c8bf8715ab274f5297236b678fcd316f625f612ebbba8299b659db4a15ee2cc0f7341249c1d76132bd9ac522128b5cd39be0fda0363b8ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a432b9b4a46a4d49d5cc3b52539384c5
SHA1807b97eccc3ba5fd8025ae82ed0825aa4849b834
SHA2568929e6e717875bef5bad6fd127c2dd1ae3312c1a60500c4a7cbd8bda6fee246d
SHA512ab62fe2f4bfc6f395c5cbe7430a05ce08f3a11a5775a89d960f821573ccc438eecbe766bd7fd1e9207f565b323f11052c2c853b3c5cc3c2804a135d6c48879d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cfa73330f6e515518f9aa2eef4f66d83
SHA1f9e3b105585a9b29c5d9fdb908686ace315b8edf
SHA256d63d2712212d0b14ffffe7ae10214b137c2686ed67cfc2c5ffb3b79507b421e5
SHA51226abbc6302bb30f61b6020d7a26876865b6a21f234d167d4ca41e1052e3713ac5ff3dfa861a0e951e66a86705978f3a4562c1a6779740bd2e0da64bb03aef433
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2c0dce832e676fb1ea21c0c2342d652
SHA1fdfc7f8e7cab75598759ff2aa5aeb0b2f511f374
SHA256674b196aa62483a008e3122acff4f53aae785c3246b8d3b325434af98a7f77a2
SHA512e62f08580437babb9e0969a46a6c9c3215df807bce6b6a1614a954e73b68fd18acebecc8030680404b4590e4478aa723aa7220aea05d74317a92f590a31b05ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e1461757ea4f428a7d33fed70fb477c
SHA148eddc04ed8b653590df4c42301a690736e42c1b
SHA2568f44f72b42ebe046fa01ef06b284274c5de7727382da6b4443614fea33556bb1
SHA512f16952833b5ae88122906f218ab0b9188fd8b2b23a46c72f8d22095a1db617474e2e0dd8bba5a19d56a509ab89d782f2e1b54e8d2ddafffda0d3e359e83b5cdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bc42bf407df40e95b1d624dfdb0851e
SHA187d2cf25d597de77139b79e9a946aafc89027134
SHA2565dec0aaafa7dab1719da8204fe691cf4e519ba0accabe91a45684c89a645b70d
SHA512aefde5bdd84d110809244693cf2c6901c5e7082b920be484a627cb4cbd8dc81a5b3b7b30db8d123382ae58bcfe04bc878e2e147c3b2d63aac488e064151c120d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5362a843bbc2a977430f4a5240c716489
SHA1d2e49a32f40ea43084433b1947afd2d6be53cc5a
SHA256ecf51e2233a5f66eb852ba133f40ae5a4e91a8179c9851ebe23edef5a3faa68f
SHA512a17e6a6f9492657e6b6336047398f6216401aa18419c6f34b4bc5362119e31675f79e9c62b0e7d6902375d62d1a1816426168954c7c21a10aa2fc0dbaf8c2774
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a