Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 16:42
Static task
static1
Behavioral task
behavioral1
Sample
4233bee10bbc55b9519691b10f33fdf7_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4233bee10bbc55b9519691b10f33fdf7_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
4233bee10bbc55b9519691b10f33fdf7_JaffaCakes118.html
-
Size
461KB
-
MD5
4233bee10bbc55b9519691b10f33fdf7
-
SHA1
37091eb45935dddd5bc6353f2e89cf9339e5a9e2
-
SHA256
58499ae0a686b870b909bcf8dde2ca105ffecd776076c30d85c114df34ce1388
-
SHA512
3d74d8c9fe3b496fbb0cd96ba08e8b07cc270129d17b1b295bc3492aff6c82ef5e3f1d112b8cc0cabc886118be03003d590c3a595604183b024ef130e1c26294
-
SSDEEP
6144:SDsMYod+X3oI+YJsMYod+X3oI+YYsMYod+X3oI+YLsMYod+X3oI+YQ:A5d+X3P5d+X3Y5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F52760B1-1210-11EF-B97B-5630532AF2EE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000008b5429e51c58e3984cb638a95fa2e3ca4428e9e2479924eeae5c1090a39bf742000000000e800000000200002000000087ce574162d7b220309edb10cd6a1e73aa4482b0ae3b8fa68c750161d1bbee2d9000000024f0ba395081039f5e372b14f16f5b75b877b1c7a7fb2aae8fd277bb2a065cd29e36445e0491968fcbdcdaca7e2498f851496f61b407e61fe6545e8d6888fe91cb077151919194e33ceb26c86f502361eeaeea85f8af8fc1a559c5c1c0c9590cb6ad8111870477fa0b6b31d48f97834af6bfcab0e9c283abfc36ecb9b7861fec5f74f248fdda852f0459f328729d521d40000000812da769d2086608bc2504be8d23b4527e3b260ad27373c49bca400a3cb5f711fe72056167c5b77bd93dc83265b44cd6e73a01f537c4de0e5ab9217e15c8220f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000000fc5b824e86a409cf4559675229a7f18f93a7ed5d8280eccd1215ebe7c76df50000000000e800000000200002000000003830c4c32c8acc70bd7d7ad10b2342fb6c68a04e63e469fe1099191f23ca5c0200000008bc6ce24c590b2a501632f0546cabef48082848c239e2896f156cbcc8c3f35524000000025f792bd2f098289a32fe34f8b108d5e674b3de4ad429bed271b27c413c76d3b9f53dc20031cc6ade99d72a0c07116d0b611360ecc7548b6e9fe6a5051c99ad0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4014accd1da6da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421866818" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2188 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2188 iexplore.exe 2188 iexplore.exe 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2412 2188 iexplore.exe 28 PID 2188 wrote to memory of 2412 2188 iexplore.exe 28 PID 2188 wrote to memory of 2412 2188 iexplore.exe 28 PID 2188 wrote to memory of 2412 2188 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4233bee10bbc55b9519691b10f33fdf7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2412
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e84534949024e036b99e656f196843bd
SHA1d972e5f58209e6fe44859c1ecd62038651c86eda
SHA25697a2ea93c2d78be1307c67b12b56408ea0d47ae285d5de690a502b8af4bb1bd1
SHA512fbe177520a3f2c0a587a22e0daf03b34e4d77677008b7776c0a7bbb8a33473c8a3756a5f15109386e5c10d59938bbdc5fbf12d8589bc73c03541b65a714e98eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599d1266382c04d8eca688814c7994454
SHA145e5db39a97bfb836023424c8ab1230a73dd2179
SHA2560d0f10896890a59717c1f8570473167de17b4daf2633faee4c5a688265d68b47
SHA5123ce55a7db4ed78e159d4416622904f64d09542b643e0c33436b0e31b8710113bd29c014373a4bf8df870bf46c9e5e2c427d8a6b7168608336ae798736e055bf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c3ada3cb3f01cd23f9ff59233282736
SHA1409b7b6dd298725f92dd924b733091ee612272c8
SHA2560d9d9289fe13bf5697188425081063e649a47142723bd03a2a3fd08c653d3c9d
SHA512117464748cc1b80d2dda439bbd102f995a3959daae9a38061a0909d1c948619d3bdff2a84ca91b84fb594cac87c833be21a4cc6df10ae304df5fff025a67b994
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af15baa89aa24b9848b5ed6f76db900f
SHA1f732a624abcdc22b23fbb9df300de67eb459f1ba
SHA256cc1e3e434dfbf75ea668f905bf42f7aea112069b0bcd540d524096f3239dc314
SHA5125d923a1ff0a5ba1139663d73cfd4c7d0e60a87525a1d52e925028e21725f6612d735b4c679921e965211436c805ce0f1ac6ef586a9b597783901df6543a42c11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5989df66ec2e7cd8fa260e6aded1cbb18
SHA1bfe1a6d7466bfcf718437e21911edcd2f006db10
SHA256b122d4915a396ae78a68262aff7dc600e229c52fde43ccfb14454996eb1ae3c3
SHA512a9640d8d86012c8bfddaf1342cf3a4b1f0233e6754c3c911650b45075c0adf69124246332a30a0da0b8a01f94e219a6e73e16c481e675613a1132fb909f1ef63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8330b1aac73e1a2de13072e70740760
SHA1f7df2e10206bda92e92beaf682b890ec972a5572
SHA2564eaf0620f57bdfbcc8e141c102535e16a44f320a16941263ea355bb95977d645
SHA512fd6dd2327aff7856975fa5889e84af35ff990d9ee038e7c796e5ba56f1a448fe6929f1f0b7ff12b6c761cdf9913f0007b695fe7f3f9dac883dc96e4a5f943f45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d1d2e9eeab613998f0930ad3391c268
SHA1ecf9c5b99041d7df62e5348cd510e4a7fe47437d
SHA2568d0181515bf58d16769fdf3979c2b22ee8cde50146f87c4f0d889f0bf810f60c
SHA5123b4fbb15f23ea357d6220498ee9396e6ba772686f72ca931a36a43926227e60892e75f7e7cb7ba8522647a8670a4c9e74abdc861974e9f2dc1dbd065590905e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b2d8ae56a94e27a07d35e83fa7978be
SHA10c6df9012cfd9a98652fab4c6f5039acaa886d4d
SHA25612c325bd53e584adffd64cb69b71677312d97bb381b786858aec9e23e4d79e50
SHA51208befb6b45a47f6d0195db2ef627cbc9c1f9f2ea639d20d41470c7cb9c588241a4a4d0bb3411155e3d53d957d274f0e5c2276991f94198217e29da64ffd2dbff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ca89013837b3b9dfadc0a0719ce9412
SHA1d48288d2cd0822ada5aee622fe5404c30b008c76
SHA2568c94ea3bd9fa017614065d98359de81f984554be4d28cbbf6772bba4d1cce92f
SHA512f82547e7d2aec411efd37c6ff4582a875fa56b6d08e9c853c47f31436257b7fe6a26030ae34d86942eb78141df027dd6cca87ce4619cb85191af27b7c0123edf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5493e7e35966c8b863092ee4d0481f062
SHA111cdeb4b42f308db96a611df80e48c2c8df45aad
SHA2565def6f090cb5fe3f30e00b53a1428150603f6db9f3b387a949d924b713da21ed
SHA512c76aeb56375a3cccd7ed3802fbc5af426462fc4dec02a459c661770c9e5fb0ab29953af8ab7372a1fb9676ba99a708700522e5566ad47650a93def28f10c1d7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517cefb39efc09f90711d147c2c7050ef
SHA10f6ef2923f3bcb609b073e25ae7ca451361ff71c
SHA256a51e64a64b7bca96f1f45022d513541228191e59d00e018daa11c49b1868e542
SHA512d49047536ce06f9c7e9ad5c5dc97c0297dca69a5fa0fffc0f4d885f9559baebfa564ff6a9794387b196bfdefe681dc7627f0b38a5dc1af3c42d0337f627a2ef7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f08b530dfb744db2c4d1e241c4b6918a
SHA111ff806cd92ea268d6e5c307b392cdcfd96dd27e
SHA2562e37344c243528f004d3902a25166f03884d00890acec78918f9c4c1a4757b45
SHA5122ae685a1b707dd84a057e769696fc730aa62c18318f25ab1c1a123c363837d799da1a304532c355f2e0a0c6370f1230e17720642626e12a911424e1c1072b5d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523d5cfa938eefe6c60f6f8b70e6c75a2
SHA180e3627f78928673447f2e37f1ff914589cb3ada
SHA256e0233c23f9a56087f717eb4f12d1cf6a28463c43841b17dbb1cbbdf5cd6b32c5
SHA51227d3ff17f35ce2e2b790065ec0aa3032b55ff84dd2385d30c172977c9f87f28f38b552612728572d67de19452fa04f1fd89abc9c8d10591adcbdd43f0ecd585f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528fcb77b2f24885bbe565d05e97ee2e9
SHA13da170a681d8cbdc4db64dd4df651038bacabd11
SHA256c639f0af97e822e1d0a7291effc587d3957255d84a82deb75cd4b1b5352150f5
SHA5120d1fd0a8ce4a8956fcb4076165e8a5df768cbd89d152d766857d87afb62249e585947eb4c333798f3c4cc7aca80bf3980ab5ede7df1f609d27eb6257f550df48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ac0f0069d8ea0bac78b074313c0e849
SHA118089d9eafc80e333ae417775df01ba6b767c634
SHA256101c7c15ee236f13ec4d0657c0506cced36128340e75329f3e923d4123656faa
SHA5121045d94017a6773a2e96e6679c1ccbff01e84fad6c7461124e1a634563f73b02a05985032d143fcdd60a637e438764db3faa3d02434b9f1eb83d0d4c5385dcf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513d3fdbf670394cbec1d9f564ee689eb
SHA146cd46e89862ddb687e1ee15941955710f5bcaba
SHA256ed7ce1c87193127b43f920692b127a3e4b4eabdeb0076a2d6ba3a0b698fe18ae
SHA512f8bbf1cdff7743ca9b85b14e95f9ded9e11e48c95ab6b1ddcbd707ccd08759474e6d969c59871122380cab98e0945bdf3551e5b055776a8e3618cf9654203155
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad49e81cebb9325b049b7519ff3d061b
SHA120cc281fe4fce1c40605da881631da9a00d7f745
SHA2565d84c674f38fc7ed06972885453f7f347dbc7e52aab6882c128ddd6f410021aa
SHA51283fde4abdf9198a0438484e1dfd1269940e9ca8d91a9503e5dbcda4769558cd055d490f674a91378d7da6cc98c8919c749b07357738741a29894a76b6903181a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d19b13e8305847204092b6487cfdd0c6
SHA1e7b39c24d01b0f24fa0d44196e9352da6c4ce215
SHA256dd2c56dd8e1280d864f9f1a7842d374587ce6b10a7286f47e0e8e54558f59aed
SHA512d5a1382a5a9e4a464fb4f50968a8e248591454acff809c95394ab971434cf3686690c851f4ed2b08a1cf400385e30350c67e3bd2579e6da8abeb9f9e9c942c0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56678f417023afde56678a0d933cb2f23
SHA106539aea9f9d92c3e840282c9764e3e1a08201a1
SHA256636c5062f14c649d27ff0abe3a2f04f72308402c5c0bd4bc78ae6f6d07ef7456
SHA5124227d5c3edcade3442f5bb307b96dd1ef054cbb8fa05995de6aabb57af1f0837b40e6f3bbd13c0faf6f1fcc3a472e1349d5981b773a0abdfc34d0e0203737e23
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a