Analysis
-
max time kernel
119s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 18:53
Static task
static1
Behavioral task
behavioral1
Sample
429470fd863272388918be68b68d590f_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
429470fd863272388918be68b68d590f_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
429470fd863272388918be68b68d590f_JaffaCakes118.html
-
Size
68KB
-
MD5
429470fd863272388918be68b68d590f
-
SHA1
99593ec6917c9bb4e1e81a6b7f6d19c6b9ac709c
-
SHA256
2598c9d8f1f5c4cf823c1fe8857dde4b4ff79342dd897deb6aec6d1a20e9da39
-
SHA512
5b27aea9d76518c522ea2914c159139fa29a6c4d0435f63876c4a6485fe6968c7008c9fad5a542c27867a0680c765360f0a396855346adf055457164a879a3b8
-
SSDEEP
768:JicgcMiR3sI2PDDnX0g6snlCd3GJoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVh:JgPod3GeTcNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000004ecde61cb0c4545df2348970851143dd2f748905bcb8543d85be5687f8225d93000000000e800000000200002000000018c1aaafff9c7e8106ba4f826cd17fcdfb7c6c686fe09b9c885abc2f3a9279ce20000000833d2444ed2e921f73d813bd7fda4c6e4c62acfd5f959f4b9be5b32739b28630400000001aea6a8972f439edfe90ae0be04d43ca8169b8fc23b32fde9338b82ba4b52316f2b347176b21f43f48e435370c8e11b935fb0f90b525b06e90f61a2d50d8afa2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 507c661530a6da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421874688" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{40730DA1-1223-11EF-A7EB-E60682B688C9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000d096b764979bddcea940daa83c5482cf2819c33a4a6bb3db9844ae588d6d5032000000000e80000000020000200000007f14210f1d007ffb4caf9849f618b0ed4e41a8f488e055ca1f06882d86adaa159000000037622709a6d8d57c04c5f87b90377a6682aaa0f8e92622985fce606eaf820fa2d1fff37c42caa819db8a9bed13e969de93e8ed503318f968a44b95d2121737cfba3f57cf0fe501a84a726f7e733b417adb5997f2e593e86e2a87a5e09702bca2148f946c2863d7f5c4167e0e5fd7e84b685cb3f37eeeb7d7ebdeab9178b94b646d1f9df7bb74bac8b4a1f956f8be37de400000003f32709e660a1e20c396ea96d1f985cfafaeee5cb789ee35de1da524079bf137529f72486b94980503b9fc94f9fd4f19b21181b6768e476e0b2c456ae2584d28 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1208 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1208 iexplore.exe 1208 iexplore.exe 2104 IEXPLORE.EXE 2104 IEXPLORE.EXE 2104 IEXPLORE.EXE 2104 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1208 wrote to memory of 2104 1208 iexplore.exe 28 PID 1208 wrote to memory of 2104 1208 iexplore.exe 28 PID 1208 wrote to memory of 2104 1208 iexplore.exe 28 PID 1208 wrote to memory of 2104 1208 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\429470fd863272388918be68b68d590f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1208 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2104
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee338b766f59e08976d1a460c874f4ba
SHA1766b058689346eb92018f3d025bc3dca8c50b53b
SHA2565bce05c10ee6c6443ef3652b23e85641253a00ce927b25e138ff9256ebc7d3f6
SHA512de8fecf926cbc0cd35a4b3b909f0abc441580f21e82ba1c5c0a754ed92f9e3095b0e354b689eb4452c6f17665a0019833b21450e6aed6dda726d9200cb74343c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537b64578ab288348b651ba66a9f41eeb
SHA1476a51f5d4f198380bcbc72a91b12d1b6abd11f2
SHA2560f5b8a0325aa17c17b10c68718c2fa53f49e91106b760d48af5713432e349557
SHA5121cb6f695f62a8c6a1fdd2156ccd2d1faa5397e18b169abb9214fd6d90140ffafd2f5324d22efa5840f00ed4d92f58e096c8e4354dcdb5d8363af69630efe140a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf19fbcc9d58d02f135d04cd91ef2ed2
SHA183c84d91200029cf790d378db5708d27f9ff6be6
SHA2568e0164113e08dd0e4eda680a4977235c847d38fd79a1c1b7bafd94986ff9e21b
SHA512e9ed2c1af114c5e8b6db7cb1e9a40c5a661cc1c8b15b090e1d8ea493364eb826ed945a1d4fac354210c39b630bfadf5b2124e9eb1ac64684f7a117ada2d876c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538beaa86796bd0d22870bfee490da507
SHA1d061c2c7c7600a2ca6537a6aabbc56a09c2d5cdc
SHA256bd075d77a2ec3f4617f15e6e96a008bf7abf8256d0bee980c98c3aee9a1412d8
SHA512f6a011a4b995e0da26fbd85454fe6f0cb9de09798c756ca2efdcbf53d6401f28efae9d20fbead0dc7cbce7021b963fdf781096c1c68ecd10964c3b3483d81cf2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f056af724f2b29d167e6f9961b11ea39
SHA11963be2a6ed4e7ddab2ecd061a473d03c520115b
SHA256369772102fa1cea9d0ab5f1e43580322db5241cc9efe5700f0dd1f4143957e06
SHA51211b087194dce3698265c71211bd54fea1f44923c36dcbcf6f9683c88ec202771d05114fabd7672f84d306856f37e8c920bc43f8eae5297dbe8ea6b860e6493df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5525b912cb22b48a8579e0d59d421852d
SHA1b30c40192e3fb27dc2f859896196abb7b26beae9
SHA256274b49919474c01716f69340e24127f53ab805215af820653c1562b0bc5203bc
SHA512a5723e524fcbe2874f368416a06c8c41112bfdfed66352ab0cc7c4e87c073333d6765788d4d6dbae89cae8fbcce2a5a1a017bcabbcdb3c65eead9b69f70b8225
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1cd12f0f02f833a0d0e98b3f63b61be
SHA166138b5f9c87eb2739c7302c8164f13a818a209f
SHA25641fae9ed538a8c765d8f5ad75463ccc0af3272c54bd760d19fb4d4c5913a3abf
SHA512aa14a20db24dc3b535ab700f5d2d76068a6bc05cdd0ebef6ef205e9680ed5e6681cd77e2c112b3d2778cf541df30c4e5017a6bdb0eff0ae8e8506466c67dc22d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b066d8cd62cd9ea79ecd7410343313d5
SHA1c08c0486cc4ab077defbc5cd06dab98e24d8c667
SHA2566f7a7109b92f3b09bffed7a73bd7f922824b171c59fef1df96dfc4497c4fa429
SHA512cf4030901ab9c8541f013c1fc72be859fedea280ac18aa5c73441cc28c63e14f25240d56c4eb8a1be8b930550a8c4b6201490b1af9371f8dab677a05b2570f39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54be2bb72a7506698d02f40bf41185693
SHA10e9392cd0b0097ade5d09707736937384c4474f7
SHA2560df3b9947a1487e4e2307ee6aa0c99b16fd39aca6ab377bb7685438519dcc6e7
SHA512ac9c87213be25247d40e79e83edef9776f3d5bb02e190fe1cdc1de8288dba31b17779b21760be82c47a45ed1362cd379bffed3f516345b30237a86e5d42fdb20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e091bd4d478c411f5925c891af4203e2
SHA1d66b45fce887cf7f1d342797089da4ad18471f43
SHA25617e702bb22bb98e5745408789107c55d1e039c9c2d23fcc3d2e411f390fa83ab
SHA5128039c5f35924aee17d623ad8c7c0f2bc0228dc8932631367da1cff848e1e581196d87c40b9337c717b4ce9b4eb054e478e32134626eb0da8f164657107f6e9f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e769c60a3222dde5ff1e1f626971f211
SHA150c7c47283a73e2ccf8ad5608ad30f04669e4b42
SHA25666dad4c2d528acaf1ca1b1d595d8e244ac893939448ac3e12cbdbcf481fcfc52
SHA512e2f9fb86bb2a686dae66221e20deefc1b5e45ca7cd143b7eaf717179f296358e10f95b2606aaba9759ef34bf9a235d7bcfe0b1197366426161c9d8b14c50ed97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a3ca348411b7c4d6cb3cf8d0dda55fa
SHA1a4e73ee3e3f74ed2c99a85da424027c648e297de
SHA256fccc7f09bdeaaab8e4a72f08f58d0d277b389718d3f12b2810e093a13bb4bc38
SHA512f17b9f40ad4cb200c1e4e7ad92ec322d446f2115e1463ed252f228c70ee74c2bddec78cbbef5bde493cae63653dde99cbd87dac4ec95f387984f638e6909b28f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c918c8c8758a40afe324442c4e65275
SHA1abdb9f3b5f1547f549865edece726043e10d24a0
SHA256fe7171da1f92352a61c328f378f866515c8517c430447222e08cf49cf0f7624c
SHA512fae972ca0c2693455cf56d9fe622b7bfbe875c3f267108408f4fbf3fff094dbab60ce21fc3d8831130084a71926018827423d5594cb733ea4ea6be3be4f17b00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535f41f8cedf766aa1ff6c4b890b7dc45
SHA13465a9cacc2656c93328a21f345fc366f4b7ed18
SHA2569c51fcac1a91e1c882da1381fe87dac2a02b436c0f434451e0ddb851a09daa3a
SHA512353684244ffd3bb6e12bd1023719474c0bb8c5afdc2b322fb03550a42a6eff263b64b5951d01d36fcbd50611c7209c4c89d4fb1142f5e5d029817dade0e6115a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b892f6226b2222384ea35091b5870247
SHA1994de7dec0c97ce229c96db0defeb8751ffb20d7
SHA25662b0a6629f9c66ed707e19d673dd31e07490e339b9b564173b3c0139428eeea5
SHA512b8942f899e2d5a42738cd18a75e7b4c2ffb521b4eef6d6059a19d61799e40cc5408ddd9cd41ce957f3c0d56ec958b09e3baf2397df63154f7de1e8ccfc3e9155
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dff0402f980500a15b68b30557fc9989
SHA17024a2fa3eacf3cbebec595bcc30d145732637ac
SHA25678be1010334f71d5b0c34826b6af4c90d4621f990db76f4642612bcd1f612bfa
SHA51225bfb5e1a17be460f7c8c1bd7eaf771ad7fd090908411cd9eb3169d01140cfa4fd590a2d2c6a0605d82d006303629165687681df48eeda0acd6a92cbd8c3a66c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5426bc295960b26ce1f0af1b9afffff4c
SHA149d41e6aca0cb4481135a1068fd29a841f7fd924
SHA256b2a781fb2bfa3a521f57b32c753e7ab0575e452b19003e0faebc7c5c92a1894e
SHA512009cbc4c4596120287b19aa17259ecf28e9889efd6a908600fb32e5bde6a71efd9a0db11d9a424ba551781b1485eeefaa541de91d5c4dcc3f23f833c7a3f1bbc
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a