Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 02:45
Static task
static1
Behavioral task
behavioral1
Sample
4439e97e2348125082ad73b111f40e19_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4439e97e2348125082ad73b111f40e19_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
4439e97e2348125082ad73b111f40e19_JaffaCakes118.html
-
Size
460KB
-
MD5
4439e97e2348125082ad73b111f40e19
-
SHA1
a95392f5f578be8623c1216b90cd1ed18202ad2c
-
SHA256
14f36e00b89384e894c54e97e4b77e90f5da910f0ab180857c453bd5c84847bc
-
SHA512
704b8ce919b77d15634a690807f6a3926a1c387a770d751a99659594bbe6ef328f15fc8ad9afd4ec98981c5f5923f9fedb829bbb1ff75b35d1f3e9659f3021c8
-
SSDEEP
6144:SdsMYod+X3oI+YmsMYod+X3oI+YksMYod+X3oI+YLsMYod+X3oI+YQ:O5d+X3e5d+X3w5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2AE89081-1265-11EF-86DB-FA8378BF1C4A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 801a630372a6da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421902987" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000002ff1020eb607d41ff06f31bf58cf96d285bc80829d7b9c3530f2e58cca46ab63000000000e8000000002000020000000f915e6d4ca0c741563a7028c746fadcb9f0c34061dbedf01e2383c4d2aa2056f90000000d6259935c054e88622b7e862b7ab018c4f7425c7dbd2fb0f36143bc23d19eb67fef4864a16ee493b31fd83c5de14a142c8e7f4543854d8b4c57f58e94c7dd2805a2f8b2f8cf28f33d26cd60f65158c11e6b3275ed81a5117069e0b82a71227cfe496552d1eb7ab52dd880719e55a3780cae2fdbe271c0474ce55a6185880c4c2eb984abab50771b00769f922b46a4e2a4000000008da00115c75fbae90d2b9792cd80507e3e2c4682437ba0c4eba1bcc24a1df42a858c595805058340a0d33255cc38ebc7fc0cb47cf086293a77c1b4f12b19b33 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000003cf295601e8745c9dfdcf214be5b45fbbc448b1ea8b99f4794dc25eadf64e3c000000000e8000000002000020000000dd1e75bc6e3929305546476d4c329c79f9b021d358b0134a4c3149dbb92d21c42000000047d396400ab28a5cb556d1c13bd93d7d5c7c9d53b5dc75437cdefe72bd35f6a5400000002da55d5434e1af05068c92e156165aea889b178e3e7dac7dae3d6e5d6ff6a725fee0b46ccfe09d2ebf8f7b3c36a795a53475799ba6c4024950f1aa48aac4dc6e iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1668 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1668 iexplore.exe 1668 iexplore.exe 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1668 wrote to memory of 2000 1668 iexplore.exe 28 PID 1668 wrote to memory of 2000 1668 iexplore.exe 28 PID 1668 wrote to memory of 2000 1668 iexplore.exe 28 PID 1668 wrote to memory of 2000 1668 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4439e97e2348125082ad73b111f40e19_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1668 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2000
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59aa289953ba0ca5c61bad2868d2833c8
SHA16834efcc4d093fd5a7f51ce75e44e50af0360d36
SHA256e17f0b864c272680d27be1caabf2c87b536eb9c8df7552b3daf427fca9e0acc7
SHA5126a1e0d5caddbcbc46ebd7f7176b58d7e866490835972b702af4af33cc0aece49302113ba48e6875543917b5da1d2402c2647be8c1e505b52c0572b9ed5efe01c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59678f3921a2b65da89da4bd4c59973bb
SHA1a87843a3f066969e5968d341fd8b2230daa729c9
SHA256c32f5e81b20b8409c786324ee11cfaa61bcc71f432551fbeb0f2610500ce10ec
SHA5125ee625835496deec91fa1dbd38d4661e2d0b34c40afddcefd93e466983c695285d5da894ec1b782c284120cec293d20a2b9b5e655a417feaae234323d1a8834b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558eb8f6e6c7d92e3220d573c61c6d751
SHA15b0c63262f73cf676c7728dbbad97a89caa0eb96
SHA2568830bc1c546f9ce1d8cb842d9b73bf47136acae0527c1621576d60bdbb8d85e2
SHA512bc17c79b25eba31925a53962b339e03ce7ae50d055efac8afefc197e7d9b72a1475f0fc7043d67ebd170e2fb57a0e5f59af620bd09fbd714cc5a24235d4972ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e9215a237864481ebcb7e0fee3c915a
SHA1aa7b4e73f686e9fb9e35106f9330243ec957ff2b
SHA256108b96e402b081144d0574a70c629fb80bbe560c02bbe92b7433621e455fe08c
SHA5128f0aad0b4f35377ab1a003a50a429998fa020ed88433696a0a033ded6c9b60902f1473e0e258e0db4103dd34c747dfb9044d000b0c5f12c2e1a1bc1f25abe03b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7f27fb0a1efb532950f72bf8c9cec3d
SHA1b3f3b6876028ce9614d132b0d07bda06766b15c4
SHA256d5c26097ec388a86e7ebeacb8b4fbfcdc12c52fd29889e7208add73c345f9bb3
SHA512bd0bd869335cbfa2567b3aa0859c2feedc65ac62e13675be9a06bbbebcb265fefc7df2f1fc967b5f4955651379bcd8761c2f4e73d26ed330468cc4f74df5d98a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fec0699a415bf63f8410574cba17f61b
SHA1ed5c8478c0955b7d837af919e24e51fca6ffa70c
SHA2565013498e27b90d63a1c2ba76f717712962500fa8b9cb7b2bc3b9bcc24d4a89dc
SHA512ecee140e4813908abc89f4b203d1d84fe29cf256d57cf44235a25a1a38bfdeb1bede8f3a395a515f828b80bd6538fb12455c7ade9095b21d6975984020014532
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c42ff89c5b1cecb39e68afc7fc96d0e9
SHA1ff72e61794241878cd76050d5289843221ef542b
SHA2568cb66fc39f3750a3c6b60110ea7edfc4c5317383ccff7a435b16799e496e2210
SHA51222ad30a63b28017b7bef42b12f3e08090625a3028d74d5828bb60af0d038bfc781d1dba8a2b07c219d77f1512e35e0dfd773e4aceec5d8e23ff3690a8bbfada5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51120ca2907a52a59c1d0603333adbcd5
SHA11a605fa1aa80ad73926617057f1a02d53f5c7c10
SHA2565096575b47f5bc7d6715f0098c03cd0a443c30161f7adced595d7b4e0e317a87
SHA5122435609ddd67a874ee645cdcdf5fd3f10b62c9da12df5d358ee8eeedb09987cbd4bf8c378da72d0e6334c0d6b0bed03f73aeb2dd009a52ef80304c396786d3b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547cc0556060735be13cb291fa91aac66
SHA16799bd59729427e122e97b1f6b1e5f3fde521a2d
SHA256f1270581c3e035597d03fbe5a7f7750a8ec01ef2fa2d31b0d8c1080d7d3acd14
SHA5126ef84567219daa6f64c07f8f6e97bd869c0b340dbedadf0c9611b738e6196da9434ea257b600994904603eb100a7aa53cd1e463e09530392d0bd55f3a565a2d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f26579b8c7e9738c8654caaa7a2777c
SHA1f5c7f1cc1384530e445788575eb9ce6b2e2467d0
SHA256f23d83ee1d222bbba96d36184bc0f31f5981fe3083f05b16c760f3614ab6ec19
SHA51224234cc8b7aa7908ace6dd6f707dce2fdd9413315dea4fd60da563991aec917c875c31d2e7d1a274c50ab5565d933f331ef0b2a45714acae2552bc467577bfbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aeb64e0a433e719119115a9a5c188ab6
SHA16bb9f0a5a7b2f93afe1721da6bbccb2d011c8f73
SHA25636f9c90e17159f37468552384883338751570431acbb4208c8da4ed78cc119dc
SHA512c7dd0616599923111ad1954053f60fe21db5a2eb98053456f1d65035284e6231c20709715789c610cb52fb251ef314ce40ff861d551d9f0fca2fa51d26d737c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4cad2e421fe30b6fd9f6756a52d8a25
SHA13fba2d3a89f12a2432f29c5f7af4e248fb921340
SHA2567bdd82bb03bf6e3c8202e3e6cb720e554eebc6baa7d7153616c19ba7427ef020
SHA512fb677bd09e1b1bd8eb455f2a6d520a6ac4b1b4f8229f6dff9c9bb7f3c64abd7a06cec7a4d2367400b4cf7e8a4f515f32e90842e6564dcf7a207031a0e3bf2be7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b719f778388a9342be24bfc969f3f5c
SHA1b1d2da811909d6f18e9efd75bc57eaccce307488
SHA256a8877e0ef48ae9008ed9691946788cfc90fb1afb57e1f252466b8b692cfb2a99
SHA512ec95117105a8036ccd38b32db69c879dd6bb767dafbaf41c316a6e3a4a4dec1c72f54145a17a6bedf2b18a420560ed758a7cd1a9cb254e8f0ff8115fe99d1bff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570f543bf7e5aa8048bd0142a586ae715
SHA185144119e3127cc48753b4e8f0b4afdf5bcc91b7
SHA256adf7ccb89c78dbf6263acf0370c16a16100b3a8573715c389798af6c073654eb
SHA51262ed9d8739e4a4339056a118e42c0baf1c2afdb009bc182632d9bd9b1864a2c597df7a33b8a29a454ad900e581e01f125e147481950849886a04a402b21613bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c70bd2382e92d52b82c947ff2f685f82
SHA1a34e72f305db739ffaeb9efe1132527463c19596
SHA256bf232bfdc05761883186e20726615341281b615a1711055f1ccfc6a889933457
SHA5125689ef4b819d6c63c6d206440e5714aba3cf296fb2ec0dd041c14571feb3e62000a323b6ebf0744eb2186a64aefc5db8bcbe70ea6cc918209c74018129e077a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540548ec3261635315fc4831e5f97e660
SHA19c95218d02f7a0269cfbc599f62059c9881084ae
SHA256a9a0d10bb0813ec815e4d5ca4a7d935108b04d8cf75a7a9d65b1024147999597
SHA51272c45364c25bf97ec4b4fb91473895978c18e69c70fe353c6472a2b6a64338467e001740981571cd112715b5441fb09b65d325e5b356a677bd99965267ae81f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd8642296e752c869c4bc92c2b0e77c7
SHA19f36883af1538e6b8e0f9eddf1e4b755f621bbc4
SHA25621c96d64ac2733108d4d3ea362bc48692a1c3ac41ac553fd3e8776e12a5a29bc
SHA512c06374483c694b1537becd480813c9f2f764380d12fe36b7de72f07192d412fa1bfdc085df7fd978e0b80d56c49af6c3f77a0488df37cc6ad25ce6df82f7d82a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a