Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 13:39
Static task
static1
Behavioral task
behavioral1
Sample
466fc4fd53b556a7c1d21e47201f45b4_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
466fc4fd53b556a7c1d21e47201f45b4_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
466fc4fd53b556a7c1d21e47201f45b4_JaffaCakes118.html
-
Size
46KB
-
MD5
466fc4fd53b556a7c1d21e47201f45b4
-
SHA1
ee036b9e6733d2937b470766b6cb17e660e1b6fa
-
SHA256
a4631022c5d15e7b98efbc6688cc5c23193f0f84c9642b4ddd36ab43e95e4d69
-
SHA512
2668a2acd34d4d72678261d94696d5d3336b2757717170268a3ae0fe92f48efafb77a8c5b4232ac8559b6d704f0b7beac585f62d9135a2ed58d2b4a66b721961
-
SSDEEP
768:3lkSgOriWNQuavoLGbDw2H/XqG8uNUT5o29Qs4T:2VDw2p8SUT5s
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000002352a3977ed91802d0a3ae471825fa226fc2da56e14b0153802171a3103491ac000000000e8000000002000020000000f31de096d4dda335e354171f77206e32c8e06de38c58922d74793041b351216c90000000a60614a779ccea8bf805d941b178564616cb44882ae00f6c93f4f96544d2aacbca12656d8400382b65e4c1e363bdcaa00794e48f345118dedbaed08fbc30f060239e0c56352aeb64385be035e51ef2b8cc8237372862e0e37fe739e394fd68c7dbdf11cff60155a6b0263a1fdccc31426cb12da295717bff3aa07253a3cbd02c18327697c3ba14319a8b4586889f7b5a400000008ae0eb834483f496aae7c3d50286db73d87beae9becfb84d06c8507b8fb0fe5d45b11041fa3eae9ea5e84cc5ef1962929b24d789e83b14db180b67af3d634dc3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000003539c173a059800d0dfe50c523c0aaeb563ed22b8c10f36c793dbb538f1eebd8000000000e80000000020000200000001357bdfa12abeb34c5e52fb8632fe4799ee3f8c1f9305f4ce225643d21b1dc7520000000246d46e23d85ef6833929936a7c376f02b1c56c8b8391d9be980b4d57068a395400000002356c9accb38df7cddd528f65965474665aac97000d773da89d246b87fc2686ffb001eb92d3687d8ed8460e0ed18af58ee87c7363b1636f23eda89a9a560b877 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421942250" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{958605C1-12C0-11EF-B781-461900256DFE} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c04bca6acda6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3000 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3000 iexplore.exe 3000 iexplore.exe 2812 IEXPLORE.EXE 2812 IEXPLORE.EXE 2812 IEXPLORE.EXE 2812 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2812 3000 iexplore.exe 28 PID 3000 wrote to memory of 2812 3000 iexplore.exe 28 PID 3000 wrote to memory of 2812 3000 iexplore.exe 28 PID 3000 wrote to memory of 2812 3000 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\466fc4fd53b556a7c1d21e47201f45b4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2812
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5696b40375ba1bf31642bc0c02b4c4504
SHA1089d4f3a6ef2c72f17fc835d758b959f939b35f3
SHA256cc3d545f64a50663b04078f98c905a0aadb525dd61447cf51cc7ef9f8a977828
SHA512f9bb1dc276ea517d899ba446bbe2fa899ca4f4cddc8886fee4ba41f2af57ecf410a6c496ad6c129c28eb5117c83706e77d27fcfae9cb731128d6474d95a959b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dde46d149f7129c3392be985a37d2ff3
SHA1c5e8900d469ba084683d5d7a869fc2325ba0152b
SHA25695d41bc5f0579d0c6d1c917a35f0dcde6d1d4dfeb959161214d61ae75da560ff
SHA5120ba4c6d510ffe3b1e7091e986bf788ff04b1bae6c546bd5fe6e3b81b6cc5396d2a65aae17607a93e040a45183d16c22d5cf4f5aaf2b2b3e5b9d5b61b4ddf22bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b9d1a532eac1f27456bae8920cf0ef6
SHA1365f2dfe8ca27c0234b257e51e6a257d491bbad9
SHA25626a94b205ad2bbc5d8f2c83e49388378032e0f0aab5cb467095f8cf7c0dd1eaa
SHA512f0e12d3ffe0b435ea25e95817fcb2bff0fddf6cbd58a5214e48dc147a75f31de8267d36ab9151c50c6e9d0ee36cdb47069691185489dfbc0a71c1c51f2a15868
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5883a9e38fb40b0aa4cd806e13f196850
SHA17521316025228c2f5f617e6894efb72f8d213ef4
SHA256ce7079424e8322c42ca2f382e9bfef9ee612cbc935e5843a9f75b34d3ae16538
SHA512568026a64039120466bb4e42a4e16aa6f6203f6759e357167f70eafd2331c865a7ec3267fbcb1d40f9f6e26dd287db406cd4d264f2378180bf98b9237f2c702a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55eacd10b0162ea367a32760e4cb7f0a5
SHA1b8412414b9eb3e51cf342d9031929118744d3408
SHA2568219412b12eda2fa1f029325ebb63d4f4f8a8ac2b01fa85233db496f631f3125
SHA51209636e846301532b024581c12ef0a5f50026219fcb6df6c8da6f36531bfc94e41b33cf6bdf8080328b04d4f73b5edfa9b6b578ae6f7201f05462c722460cde4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f855b7a8dbc1e2bb1ebb66408394714
SHA111fc945be617c2bc55b25c56bffd43685e791f69
SHA256ccc2c0e950ce07c520e9f712426c620f8873767b775c3883d642555663a18487
SHA51258ebd46953648dc6ddad0e64fabcdfb2d60acbaf08e73b47a6b332d3a7cdcd16675cfb422e186d64239161c83af28f9f92f23cff1e54d6193d03bc1d83c8194f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8f8093e739b612c864f04866b6ca4f4
SHA19b38ff4331265b524923d46e20030df8948297a5
SHA256de12b6373ae960dcd489b559d72418c024db4a19500094ed1123da0e0bb6b916
SHA512f8253ec6d487484e282e7db6a77e1dcc325c62c2e147f90222ec012caf13f35cabc28cb8f5054c4a437a58fedf31b21c0566eeedec87bfccdb57a26a57bff47c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5691a93f695d6ae4eb3e4ce91c9168f4d
SHA159634bcdba3d97953b5cff0b749a2c9151f418c2
SHA256a12b35739d41cf864218bb978a9b549476440d2b648da431a1144bd9c97f0daa
SHA5122108b59a1d258884a0e348766615db8b1e90329392a9fb43a3c5accb1ea1ec9a3265cc370c886a3608059038c36d586241ab6cea3193263c7be70df3a3acc089
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5629024cd4b842154d1f51a088797356b
SHA14ad43400ce008ae311d8c54778f550dbf111957c
SHA256712456e424f13a2c01fbbe45f888e2ac8abf6c0b1d36bd57b05f0c6d99ffd980
SHA5126384c87d270bb429aefe7bcc5d5f20a960c82fbdb9d68c25e8d50a92668166c8365e7d55a11f1f065f4cc232a284c3fa56124f3efe35bb4f2257fa7443d1a0ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c23cc3692588c385781797ef23932218
SHA1e0e30ea1bc9d4c4b2b3b02867af3498427a3af47
SHA256a476d7e4d422758b290714dc0bb251c7ecd868974b9374a03902cc8096e9314b
SHA512856c0ec37124a5753282ba6eef0ff204c139cb22789af974fd045554a4e1cf0cd9cba6c76f45f0285de75e9b0a8610ff7aa9fb2f8740287238b17ab5a99d3e38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb48491179bd95a60235d95e9d40ff36
SHA17f3735934eb87f7a38ae2ba6984d55e86ad47c54
SHA256a199236202051300e7f26d0725992c11f3f27004bfc81dd9fffd35b3e8fb7c0b
SHA512b054dc2908e22a4b1add662031465c721cbf6c6c71d6e36a69cc018099b6e0ad28a5c4526cab57bea796b238de0b57d220defaee9340a1f69575dd9bcacf684b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba58882ba7cf049fb71ff3323905a273
SHA1be9e996646f84edbf853348e2fa14b9ae1e6d32c
SHA2566ff82c6bc89da3962adf92cd434965c23bbfb05f598de79459e00692bdd8d0a7
SHA512919f4d149a1730d41134499c8957791761bc2e7049216cba2cc0d5c94f19c2168acfeb7d438bd4757529a6428659f72e1378e8b60f3587a6618ccbb5853e76e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5476a6ee70a1e560f4cb5f176dfe985b5
SHA16592e5b175eea515efd690696be6ce46c743c52f
SHA256e370c46bd22b35d3da6e36f4e93eaf42b184c37dd72894dbc2f04a0b34c3c4d0
SHA51245722f158e410cf651a84aa8d58c9647987e333e289223375df50149d88ffe06a1faf2bb2935b8b15c713e2a4b30ce5c315ed04431a42bd9e44ad497d5518a55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559fc47b18f64086565a622e4965dca88
SHA1cd41281565b77cceca656d4c143dff5dd14babbf
SHA256db88b4f7a8a863ef8207db49482b1ce6cacf6914daaf87c31dd925f2d0e52f45
SHA5126719deaaca68ebae8880ae11a49ffbf2331321809aa5c7ecc68457ca033654c479df64a23bf5fcae586e0bcf00201d4ee101e03d8b4822f15ee4d56ab0277ead
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54bfcc88dc045d65cec6bdb70b522c0ab
SHA1ee686cf3e9ffdab79cc2c73f9180de5561138d1f
SHA256b9c985a38fe01d697faafac96151d87e8dc5302d16fea793f40868d5bb8602f0
SHA512fa3a2aef2c27e20834a2c8d0f74a5014c9cd6a955930ddcd218e4640697681036d56a27cd20eff37d04831643a06c77ea8c7d0d1c0b46f55ae9644deaf384982
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2c43d8e06e4ddef41885f8ae592a838
SHA149305a1e7612c3f1f90796c3c14b271f113283f7
SHA256d24dcc8f41614f2a9c517afafe0a270382db9ba20acc395ef4d3a24bc24632cd
SHA5125df51aec8b4198097c67b23463cab2824e6c6d6a8da93f2eff0d7017e224473af73a34d13836d3c8bcf831c1516772e3681dc79e3f199ba49dbce7f7e57192d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577710077e3343a6e54d308b477a4b5e5
SHA1abdf0824765346ae3e1b96e916b92f9d6b3e784b
SHA256815736327343fb4185ff446d51b3170fbe777e49c72d83419e7aba2354deb317
SHA51297d0d284af409be60b431687e04f9fde74eb7428e61b165a1d2b80698a1195282fef2cbc7b0526f7212f09bbfd46d29bf71a1a58d1ddae0121e640b39c41c252
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1e3bc9816f3cf6bdcb63247af460916
SHA184071c24c6e78432b63872c979a7e6947da16dc9
SHA256fd03b4bd871e0cb0642ad3e8d46e6beb7f406b890597d6a092cc860f63aec3d4
SHA512ee1a2aaf051519d780df77b2fb609ab6eb53376b893d3c1c8f4d0190d76b1484429d3dd87cdf844b2037f6c48af77b6b462f974695841b65760aabb4dd08e6e0
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a