Analysis
-
max time kernel
141s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 06:23
Static task
static1
Behavioral task
behavioral1
Sample
28b18328a4c885cad0a42e83ffc9411d_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
28b18328a4c885cad0a42e83ffc9411d_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
28b18328a4c885cad0a42e83ffc9411d_JaffaCakes118.html
-
Size
139KB
-
MD5
28b18328a4c885cad0a42e83ffc9411d
-
SHA1
c9b278c16e3b5a4593b10e920b8f3ad91f65fcbe
-
SHA256
0969bfcf077acc0c8815dbf339aac49cc1c09e1c626b66cb423eae0686ec0a37
-
SHA512
69a116de8a078e39f3f82a79fb7b0c5d08664f6e6ffdbf981445ddbc2b211c6f41aaa299d6e81a0bf5c8a446fb1a6be373339640349fa1268dae8136f8a7121a
-
SSDEEP
1536:SYpHxlbjlyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:SYplyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A3C76B1-0DCC-11EF-BECC-D2EFD46A7D0E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000407cb09ea5272cb986df5385a9e9d67e4bd6c20515c0637242056020e1acada5000000000e80000000020000200000009263a478627f8fe8098823c8ff229d8edfcd8430531d7cdaa84dd3228dd8dbe490000000faec8ca49748ac848c073865ca78cfda63de0dff05c9d5dabece9e837af44d562b7613218c6f7dddb0a430aac641fb0e27b6fa7e30644f761ad981240170858c2cfa7cfa5122e170743b9625de59e08cb9dc8db3a213a99b25e19e59814a7e1f66d9db42cd6d72858d02d3d9a0ae118e212385328ad35bd856e455a272b2d121d6fea03eb162d435e817416756040e1640000000ab41b95a81803621f67b5d7fa77eac1c98bb1baa4b0c8261d9e23422f356e021cc7f462eb05518a530ec8d572fb9e71fd4b295104d8db6eb8b28c3dbf35141ff iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000092b3ac60251f51a15cfdde442fde0c7aed7b6d9c6e5c51116f91ad6297e0e11b000000000e8000000002000020000000ef40ba385d3043c037eaae4834015886fa3e74d595245dc2a2d87df2edd9b9a0200000007e9d2e23f75a8ff5c1840dff5dd9e855af0c4760efedc85008f99ac00c3d409e40000000165da1a463cc65ed832f49aa782f7913ac855a68e6b455117e940aa6c399ff0d60748879b739c4963c86f78c1c11a04dc1b263c57bad6cb67ea4c5e5f1cc93ca iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d094d8b0d9a1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421397656" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2928 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2928 iexplore.exe 2928 iexplore.exe 2760 IEXPLORE.EXE 2760 IEXPLORE.EXE 2760 IEXPLORE.EXE 2760 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2760 2928 iexplore.exe 28 PID 2928 wrote to memory of 2760 2928 iexplore.exe 28 PID 2928 wrote to memory of 2760 2928 iexplore.exe 28 PID 2928 wrote to memory of 2760 2928 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\28b18328a4c885cad0a42e83ffc9411d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea9abfb0c712aa52e8be4a049e26d62b
SHA190eb8ba9150abe48886733cfb01cf8d4d5712fd2
SHA2562153a86381f3340cb6c9fcc90f1722698ac6ec7b4dc92c2c60bb882fa6c59460
SHA5124958e989804f43a1cc4d0b6a813606c7231048332f7cd8afa988a2d5cd7cf659deaff17ca2fc746734a49ee6db872c33febfb6f44b3e54ce14ce7512e8112bf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5944f676827e503b9553772fc5665386b
SHA10cfaa024fc0977c0fc4283aef8d975291f54e47c
SHA25628a00ae99ff85d1feb3c60bc4181d7d2c645061b7f71fe7c43040ef24fa4c8be
SHA51226039719a0614acb10f898a39fc4a8b3741f829b4469b1f781b72a05d247fa62a1ca0f3748933b68589b12442766276d8e5ab10b7c93636ca1a539b37581d880
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce574822fc9843be87daff7e70f03494
SHA1c32324e5db9d80bf5fbc7335a6a9c9c763eb1362
SHA2563c9a729ba6cccc86b9dbf4e2a3dbb452d04c8264fc6cda5448be604bd29f4b06
SHA5129645cc4aa4615855a33a7e99bd5d6117711d1ee1a3e7ddb338167f600871b3e69908bbe5a758b15eac4a46995424ecbec0db30392cd79231b378503f017c99ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58113e632888d05da773bcd68c974752f
SHA12f19853cd0a0b11b1a8d0027f2dab9d5c8c2efcd
SHA2568b7945018c07ad420b2cc74a743a91912d57a86ae912f392e24851044a2a3a1e
SHA512fcbded49307026bd9ee483db0a426449905c57d4c7191b9e820b64fa9fa40e0cd3bea3b9f4508485b6bef16d2bc6a0629b4545886bb3fdc09222b9febe79e9e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502bc9a7baaca24c098221a5d8f326040
SHA17509df3ceb1a1a1cd9aa4a2c92104f461cd8ba8a
SHA25643ced15e8777956372395c59aaf82fbc80328ac01da570ab7096b6a8df0a8caa
SHA512a5608a92692620bf0f3bbf032f07c1c41e2f4db1906550f293d0a9c2f58d40d932bb86da695262aa276c579dae51bbe489c74dfc6269f3ab97043c94a1ad63eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d8df288def3c3bc6fb59ca7774958de
SHA18e2ce71955275e9b10501c9227927b32cf5596c5
SHA256e8bd47986da6b93a6683fe2993243b27db804aa738c304cda6e062dc867d2ac6
SHA512a6236aa27f39c65bce6284ee4395f236fddef24b64896fdfd7c08368cb607e7756ca1aba0baef8e6b2e37d62cab180b0246b1595d4607aa7c06d41f5fa4bc4c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ae5fe938ebb531e01014aa29d1889f1
SHA1987d87b9bc6f522d1d2931ac37569ac62873f94f
SHA256f3f0475c515300c13711f8f21796f50dd6f750e774db265e8e3c566bf66308df
SHA5120b257830c042e0917a68402a6d5c2b943a860447d06f8fe83c63dffba02f005daad5305523005b78bb5deaaba629196871f729a43a93de61895c051e78ecf90a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a25fcf60bc1692b35763194137d82de
SHA1d7278e6efd528cdb714c01e0ca5a9ba20582aec5
SHA256d73f70030e503d3411b870627bfef5712f5671318e773414feb9b3a1ae53babc
SHA51238dc70d2e98b2a2d62835955d4aa60f45ab4c2f2c8e7572bf34b5ecbfc899b51693a8524e0fa29fbb24e12d9d05cf7f0f6eaef5277e4f5e440f5e25ffc1d0771
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5709aaadbb5d6bbe969745e00b81798d4
SHA155b66fe32fe7426f0b3671673f7a631ac81c14f8
SHA256cd8c8bdff4ab43eca778f7b0f3759e4cda96fe52b746ea30e6bc31f78868569e
SHA512452cdc7e50b00299ad6d8c319a47cdca07918fd310d07aa890d3661e4ba39773f2d083c9c2e7e8717b5ce454d93b58397df894a02e6ac3e0044be670746590d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd2eb135ee0c6314fc47722897717182
SHA1cf6ac3e0ad7c5d4b8bd70360f3d172df463c92f2
SHA256eb23ccc16c0af0f3d433904da4d2f6e62b0501074885e10217e201fe027424b9
SHA512d46947d8f593fd874bef1d25a9acdb2d4a45496dffe5c2eb767f97dcc5d3cb6b0b633cd641d2741fab44b11501db01e0620f178c77b44ddc398d6357335fb751
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572fd2b1f584c63c801dced6d8e7cd88a
SHA1fc664fd00f1f56d92d2962a0ebdcfbe5ceb9c91a
SHA2564d8e20880f923fcf980971b9f7f7f3a2519e19319dca8b366a9de75b30307e93
SHA512c75120a0fc3eea0e646ddcdb68e14088b606bb16964a0500055013c059449b35db67c0f13431d22bb40a778f5cd036a0e8d3e3908b4810f00b20743271881e75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f36d9fbea61981a70ed822218b70aae5
SHA16c98da0bbaa9c7fca06eba2647f5edddc9945df7
SHA25636f3d538e4af0a8ad92aa745d32417c25bd00a2585907f3c6fb3fcf1bd4655e4
SHA5127c78ebb28beb20128c790e445bc18bb1f7832ca858bf60057d35dfcd2998bebf9d0c3ae45f7282642ae0113bcbdf2dbb6596b63ca45251fc2c6aa0fa2388b086
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514f75fad7af73bb0e9cbff4337b7815f
SHA1ce8b8bdf71254f6033ce889b4ce0711e778e72f6
SHA256b6960e9de4a1056d0dd5d4f49f8821001c2986e35e6f412de164975ddca90e67
SHA512a9c4829ec1ee38e804d27822c50c6a8bcf03182f71d618dcca531a9b5d43f4aca3e88272fb74e307e288fcadbd9e92d07189468a58e980d58955f67b7162aa48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e954bdca33effb9919b33710d5eae0b
SHA185f8955399a2dfe090a1603cf971b55d8f135f78
SHA256dd044da87c9885126d524458402ed210aa07b545bea35ce865d65f741059422c
SHA512baebef31407895c8a66db5b72bbfd5bb0de281bfcb9f0be7562dd61c9675d8eaf3d39bf821e644e304f20438892627f55f862e3c8913041c829dcad678ed4216
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561a7c2e9457e4a54a2e6acf90774e7c7
SHA182c8258e52cdcb8a90fa2aa0d1c0771c1d9d68be
SHA25657113ed6ef0030560c2bcbb7eda3a6e809872d32f58d2b66a54e5a06d9ef71c0
SHA5124db33249bfb12b7853853a319cf6c32af48da981e98d945e252d22d2d16e7b7ef7b5aa2b0e594ba4ed93e4a167804d568d95b4a90e8bf6a721d669968203b7d7
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a