Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 14:29
Static task
static1
Behavioral task
behavioral1
Sample
3fee9ae930d61e2ef2799f163310f742_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3fee9ae930d61e2ef2799f163310f742_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3fee9ae930d61e2ef2799f163310f742_JaffaCakes118.html
-
Size
23KB
-
MD5
3fee9ae930d61e2ef2799f163310f742
-
SHA1
2a84e622c1da9585d7f9313b68b7a56432239704
-
SHA256
5855d08d381aab094c809f86eadff7a82427305c1989d0d81d2df6c7e1422eae
-
SHA512
a5f872c154ebc886d9c241d1cfcf284dc8ec306f7c43d1062c0b6ac6cec178abf4fa1468574eeaacdee720e4be77133c403268b16a52864b3a3761296024a894
-
SSDEEP
192:uWvIb5npWnQjxn5Q/QnQieLNnTnQOkEntAmnQTbnxnQhCnQtLwMBrqnYnQ7tn0Yd:MQ/t91jpv2
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b045190f42a5da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421772445" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A69A661-1135-11EF-BEEC-D20227E6D795} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000003c3cf2753eaedd1b75ebfe614f9ff498ff971e4bed62f0e5b47e1863b02181e3000000000e80000000020000200000007ad35e3c5527af2a1f89b2b3a00477190be23d870a2bb11710c1f9ccf46a753620000000b5cb1fb2920b543e5a71c9f85915d9941ea1d4281ddd45e43c69a6b9b080ba0140000000da4f26f5f65a8cad4d6075ac59586882aba126ca75e4a9918e6ff72755c0890f363398c2594d7808d2326a5a3fff9537d5616150006656097328b5efe269d823 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000e67fb47b16b8de9cc0db11dc9f6b9384203b239a08a043160330d6cbe2beff42000000000e8000000002000020000000da520e096605f00e3f98b7825ac9d3d16a6ed5d18ccfebc71f26c3bea2dca6fe9000000078f16851a596631142aa8f8361453b890bdced5b96996f8aec04c873be1010c2734c1ebd6d7f4f1438ac9df2de1d5055dd24d1b0ffbc8ab8ef8e1483919830732730f5271daf57e2939a64bd910dfa47a1d1d4c8a7871643bb9d6706afc0352c5e83a514fafec7905f911d302a6b6b78b8c2903144e54bd833bd94c1e61e40910a07c2379f845710d81084d647cdc64340000000b4cea9e96c26ca7b1c1a64f9373bed55dcceaf6da5354169741bfc8a85d7518a88c518f855df47af15b8fd1be4cd18076a4e9f3e2c8e6a380d843260c4098545 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2476 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2476 iexplore.exe 2476 iexplore.exe 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2476 wrote to memory of 2484 2476 iexplore.exe 28 PID 2476 wrote to memory of 2484 2476 iexplore.exe 28 PID 2476 wrote to memory of 2484 2476 iexplore.exe 28 PID 2476 wrote to memory of 2484 2476 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3fee9ae930d61e2ef2799f163310f742_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2476 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2484
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae5f3cd66e8ebf543d4d32196af703f3
SHA1f68c8b3885ad90fc3810fdc2bf78c5b447bdf9fb
SHA2569246e833593284780484504c1b9c646b29f9caa7228de3263aa17f5dd6994c56
SHA512b80949c725676e7d33e776fecb9b2ee7325d688a11165774c6d8a00ea41d3c8579096c13ff24b7f4432344ec7c319866f4db5954bc669bb44a86ea9c2bfd0511
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525ddf01ea0514654c387df52229e37a6
SHA1a346fb67caa5d980e9c617d8d0d10db8a2d09b90
SHA2560c4d16c9d3fd763af39b4fd2d0c9c6fa48535bceb2b968853fc333bad6625a43
SHA512e5d0f7964f83d27f5d2ec2831c603734dad34ccbf2e32763554ef953e299533b434c05649bb8747c13ec9ba512c15437f112c4c4243f8739e33a99c63008bd3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d4c1b9b6ac3e0f0ed44851d5c800ca3
SHA10ebbbd56f9e6dc5b7a536862ad913b1ffbbaf50c
SHA25667f035ad325180fa985a49f94e304970c342c3c1d344c2ddac0100b3552d7bf0
SHA512b08bf0d9afbd9be3d15a6785e102054ec9c369658aa21309bda7e1d1cd902f6f247e5755614f96babb3b57f003173c42dd6051d976c48884dc9bfe16893dcba0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f19ace2d2e8a95b292ab9af2649ad1e5
SHA19c722a0cf45585b024dd1dd6875bc1c414f9e305
SHA256fb31e5b9a2ecf83a28619aba2604a49b46d7c659aa26ce7ec4e3fed853a88cc7
SHA512ade08429a6c8a9585d4d95442495c01a5d2b9fdfc5dc512af4b43e6ff4d7118d945356745e23f2fc98f5fc518eeb295e75ee5115abc24a508488615692871678
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553efb587d0365428ae8eb5065a0a79f9
SHA151584154347407e64c865d0c3148461552af5acc
SHA2561b0ed8a8d56bd4843b715f3304d407d801ba3b2fc3382ec1b789e1d5110cf100
SHA5127cb9e1141e0f12a5224aee08980e70862df2147138cc75aa0684397f768c54c4e2ab7f1358594b2ef2e4b399ddd779f28952e02b1ea912b165d466973544f56e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58cbad25c7916f31e9b60c1ff2ebe7662
SHA1e1a76a119cf775b7f8f9c17101548a6b087018e9
SHA2562d015b36aa28157067808ea5d43b37632fad0cccdc6f4ee25fa5a35c7cfc8623
SHA512fdc3c86f7edaf304546641af2d12bf3e36961762537f8d5a68ec9095cc057b7e14388c209bc450ee454a5b1f302911502d441b6b19f30e7da0d254282653c8e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fcd590f7a638f88c61c030af2c3ff6e
SHA1f77e7054e78857bac54b407380641c1c7f28b4e2
SHA256e0332bc5f385d94cf0488599be4a2d95a97b1014a2885491bab142b3694a33c0
SHA512100c1bea999cd0c07737df12b6bc2c430186802cd89df337a538bf7d72abbec1e3bf838d5dc25a550a44f86c635fdd00fc98684f04319db1e388e5966a4964bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50826f05f797a4ba7cb1ccacb133bdcd5
SHA1eda876113394339b587f1f56cb52c388fc9e1496
SHA25647a199578c9aa09cf4eaf6fc77db1e432971397c1197af4575ce88b9d6ed5d37
SHA512d54439a159bd4d0d78a10ed2daeb2e86062248a4f5a7f22e7b0ae8b4b681123014aac10d6560556b9053237f3212649aec6b56a00a6d3f73b17f58a93aa91e8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac6047e001e5f26db60c0db15d37cb38
SHA12641db1c07e4a4269a68ec1a13f4a6c0fc307dad
SHA256bd1a4f86b6a4f6bf724e10ad09268e7718426909d7dfb650f02c6a325399988c
SHA512e9e12e4010987943ff3840b9eddf54a105990c6cb828c258261a155b7aa807c6550640e8398c4556c67a9b1cca7802260345f1dcac1ab70a81e304a4e55ff8bd
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a