Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 16:43
Static task
static1
Behavioral task
behavioral1
Sample
25c5b37bba7b9206e3948d0a763c6850_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
25c5b37bba7b9206e3948d0a763c6850_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
25c5b37bba7b9206e3948d0a763c6850_JaffaCakes118.html
-
Size
67KB
-
MD5
25c5b37bba7b9206e3948d0a763c6850
-
SHA1
7cba3200086066c83537e5eb4ef0e39c18752219
-
SHA256
45e2acc168ab50fc48d858675591698fe466c04ab0246795f43dcbef01809b0e
-
SHA512
c14e1470cecd8c71165fcf0fe10a269f279e2bbb0933aade48aa9c30d094e102204aed945a5dd10afdaa825529af756aa6494510712fed52fde544944ff2417d
-
SSDEEP
768:JiNgcMsSZ8tN99OIsKwdxBppXwdoTySqQCZkoTnMdtbBnfBgN8/oygcR/QFVG8cr:JTWgdnE6TYPec0tbrga6cuNnzIjv
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000a94633d13b69d3d241aff5de05c47a93698ec89902db3df2092a711342374580000000000e800000000200002000000043c844f89511b6cfc3e808f60020515111d5b6768f5217a5cbb05d4dea169a9a20000000d1466491ce1864cf857cfd7023d3e2d82cf44144bad844fd64f47de50ba790e14000000035a977fc57e39de0c11e21192bb68262055c36856ccce6d39e3a1f8a93a0b1a83c9851f586617ac9d39e9601d6d10456583d7fe695e1c9a541f5c389e99ca90c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000f2d2dd17aed6dfabf01d70967cd0f6879c1f4387fc24553a9c780cb26618611d000000000e8000000002000020000000f7b08f486c938ca330bd3026dd327365df78c92270d16f417d7c5d7a72b3f020900000006c25a62757bda52e375828cc65cc0dba6006dbfbb19371ec90837736ee9152ea8b6cb51157fd178ddae1e8feecc2d2f3568c5c4cc5e3f40a041890738da65acece5a4c233b956e8883597bf830fec8b5ce6363bb275d54d1866ceadbc305ea04c6aa2309f40bc602a473043f699b9860aa4e51c096b582ec45857ceb5e75c3c90eb358d26fb56bd8f7e715c8765b743b400000003b974e1c6c7ee69bd81ff58a9e7896622f2c7145682cd2b2b84fcb1cca334c0d0e9a04d098502f30a2800bf9812f8595820604dfae2743e563c4ad4c45026cbe iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{19D0B261-0D5A-11EF-A499-62A279F6AF31} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421348477" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20706aee66a1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2868 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2868 iexplore.exe 2868 iexplore.exe 2568 IEXPLORE.EXE 2568 IEXPLORE.EXE 2568 IEXPLORE.EXE 2568 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2568 2868 iexplore.exe 28 PID 2868 wrote to memory of 2568 2868 iexplore.exe 28 PID 2868 wrote to memory of 2568 2868 iexplore.exe 28 PID 2868 wrote to memory of 2568 2868 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\25c5b37bba7b9206e3948d0a763c6850_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2568
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51566892d8855ef2e4501bde9b083b838
SHA1b3e56eceaa9b0d9aa508c428b06da74ef85e57a9
SHA256a49185d2f20547b713e02c944768f8e703bd80cdc39e78e937aff0ac5f9b041f
SHA5122ae29e31c045e8b0193d9444f09c0561d3c7889bc715d76d96d3475c6c5d63515ea5ed6b761a451c73ae39ff99657444740cd6136f8e92a614aa4d959d53ac81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd48dd7df44f4a465a09e73f7f596765
SHA1551bfebbfab3e39f941d1f82aeee4e76e43881f8
SHA2563f23b11600dea9fd9b2bb81d666d6c9671346948aa26a598b73e9210b11aff7b
SHA512296b21053fcdbd4f394c918e89548a9950f251b5b38ba4546790a97327215b51e4fea6fcf6d5a52455e18366c13fb08f96968cc9f3893b9b38617e8cc9b1065c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a5f929041f42ec0faea027aff110c0a
SHA13bd2a78cdfad7d1ba119b2adfd5cb7fabe0eaae0
SHA2561f4dfd21cb82b8cb14ed4e31a6201fa4aebc468cf55236193dc21b2540123dea
SHA512bb7545e716f5d898e4355387aced65c2325db5f297ddf3bb469a215b86a268f4dbf25dabc213c0b2955b9269304e58e55a3aacaa98a48d64ab053156f81dcba3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb963f3e34290bad2b6f6048d1786f5d
SHA19222612d9cc047354ad1d9c81f4b5d45ba84e544
SHA256f29abbd95b11869c00cca235d5b4a0363e9ec7d459cf63264d48a8c9a5adeccf
SHA5120ff32b504b6f4e51d4f243b10ca5068df40ebeb31d311ffebc53be02ec518c21114e8a9a3016093f3274e219a4abbcf5a9f314d287974ddd2a8ceb44ce19c669
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583ab47b4c644902b5ec71a00e63df260
SHA17343ea965365c2035612e21d8dcc2cda94049907
SHA25696c8db738f5e13eab7f3bea7fa2d06caff8b67b14c559993c67053b77f5aca65
SHA5122f58ef5b98a3d747a02d6ad31f78925c51e919f2de5b1fd4e59bc95a847bcb11bec6358b93815674cfd1dcc7f3244f972cd34ef6ebe59cf81df8ba65d18c3ab4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c025df3bde88340592ba4927ac11fbe
SHA1c8f0064ba34377aa1b957f13c146c3eca0b7412e
SHA2564835c3c7dfde44c42aed647933bef5d9e754ddf256cd7eda0d5d73cff12d8ee7
SHA512eed9fec72a50d5e0b1fe5012881f0f5d824b529846c3541e090c09392aa342e08ffe0b7448d4e0f1bf898a52f1afb3287c9dae8e79ff597baa3ef5463f03f646
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c09c520720543e3fbf95518899cffb7b
SHA1b52f937ff2dd0fee8a1ad70423483e1b208471b1
SHA2561b50a5351d110ed92a53c279a1d3622fac596bb9db618553c893d2f2b4f7a867
SHA512975b725afabc5cb4ed5b7ac4f8e7f93bf0408add8a0d3d7dba981acf88002f3a59fba5896447a48ce475bbe47ba94f0614b31e31af8a1b74696416ba56f5aea3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a47014dbf9cd966387fdcbde19491945
SHA1a5cdbdd70b1e2d894122d520a0836ecfd20422b9
SHA256f8b610d9945e4ccc1610a9aeb48aa0d11978c8272a505b1ce14d60ca986de00a
SHA512c060045bb797bff4e210ac122cb5872c9ec652ab67ea2757b2dec080ddb817308332335ed122444de681544bdba8696b07d06ac4add0c9f50e2257bb01088862
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56accbfd539188733f035f2973d34905b
SHA1c9c8662c3ceb8d37cc132cc1e6a920b30a77c48c
SHA2565a1d9b003e2ce0528758f19209fd16d76a5e02726886cd15c155a7d81086d19b
SHA512ae5625986a9e1a1b1018e9518aab7b82f4e4a16630d586db4b132413d26f46f0276c0d150b00ebd106e63eca5a80b5aea2ab750553cbeabcda412c1ca4af64c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae1b933bfcfa96362ace93a40d70f117
SHA1013d43603a7f72d25adbda0e31339ed846650c0f
SHA25651f3bf08d982a968bdedc99059e08a3d787f4d0439491bdfa5ac4b5bc6120c6d
SHA5120ce6854e917f3b06fcdefd25e4638d9d78584c6de3d83f96fd899ac8ee13daee30d5f5c9c461ccedb5d29543019446504853f17317f7c2be85ef4ad1b562a162
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b21330a64527eccd60b97dfae141bd90
SHA1af763b681d61e9da1b6c7dc46fc3f7670ef15abe
SHA256ca7fbdb17564b0f706ac9de8d8d29eb93bf90b290a1d7e0861f1a5fd88b17f1f
SHA5120a30b1c66195b95d62fbb71628407f10611f2ae2f77ef383e4509f1324f804dfb06cae4c7dc7a429f6fbb14a23b0c27a39aff5d3d6dfcd65895d5c0e732a9b30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51dff37f85d4585df5f8cbc54bec2ebb7
SHA1b6da6500a7f5b99ee63ac407617f7cc7789cc14b
SHA256f9701456172eaea33044f552af71101e8204d46bb5f4437d8d969aedd941d147
SHA512f9b5f0c9c09dc6e5b8670b6d0499773a6962bd3317087bbd4d71c3742685a26ee514048cb849bb5d87de5308c82de5407503ddc32fc63f3ff9654a58a270608a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe52f499bba9e093c71a579fa6029916
SHA14ea6a383446d5ee993d5bd236ed77532e874833e
SHA2560944a0d21be8f95ee05d434bc7d03e67b1c27f386e78b295463a222d89e88cfc
SHA5126eccb3501b3e70db51c298259513e12f6e912d199191ad3d04eef6093ae336c9bbcec80fce60ce358ddc36d5f11f02b89ff24eab58f8cc1fbfa96bd42e30cfae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501708304124d267072fb5d61d5a746c3
SHA13108cd8d170c6615e73f33a590d6316bc304d327
SHA256d0989790e5279554c7f983539857dca257f357fefe20f84d195ed6ad2e3d7873
SHA51280f0d235a9f427f9169e3bcfbf04d6d93f66b82110c9bc23f2667bca63ba708a7106dd2ff0b4236720bffb0df17592bd0b94dea760b38b64cc3ef83ab580865b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd52b43b10021386eeeeace692b83cb8
SHA1335365c7c89122b8fe6f1725b7e0ec110fc15ac6
SHA25604bc228130145ba873598489067eab27d02457e0bb65cfc3890285d8e0b90207
SHA512c5b3962dd0e0b05081443f39de7c218b48bf75baae4fa03eb297a7863820fe600b0a8af5ecb350b14fc0360d1d5f94f9834987bb366f40d26052ef1a9138304a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa1572619449a3721841ce904bca9257
SHA1156174bbea99c4d261e74bb8c66a9f56d6f8f2bb
SHA2563457dcfe6e93b10b68fb74a7b912be3eed64f81df4b5c395e856ecfb209fede9
SHA512590226cbc95ba4e6655cf4e6c6efb323cb54f8e102aa8d13bbd0cef11879ec87ca08ea6cefb0ed1ea300a2ea4a44effdb0a8853e8f31de5cd0ab2bc2f203675a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54acc6f9a56f9010dd1e874b822c42698
SHA18a74a2d9d66aeff461399922012dfd18a6d53ba7
SHA256830ac9a33473f54e7a52c784cfc63a03197eead5597a41c48d03545a6ba3f697
SHA512125641cd2981b3dc47cd29ddea5003800fe3a1f7e0e771b16198ed6dc27dc064741d2bb3c10c9477638ff7836d9f93d0956cf4d31867ed32eef433a4a9e1174c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51382977da95dec95be19c180872e9a08
SHA187774bb0f4ec7c560d9e073c4d423b434fce5b18
SHA25686a6a10b91961dac36434f068ae086cfae4c60a378bfce9fe20451dda34e0fa1
SHA512dbe683e2a123d05418bb8654f3bcbf3270ce26ff8d58f51f80b1bb5ca3c21217fca0a1a1418dade7e24eb2e08a9f549cffa69602d3bcf90cabf8156dedf348ab
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a