Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16-05-2024 02:22
Static task
static1
Behavioral task
behavioral1
Sample
491903f77c3dc29797d1b276b09f9aa6_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
491903f77c3dc29797d1b276b09f9aa6_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
491903f77c3dc29797d1b276b09f9aa6_JaffaCakes118.html
-
Size
79KB
-
MD5
491903f77c3dc29797d1b276b09f9aa6
-
SHA1
6392bb28705616c86379b8f2f773c89843feff20
-
SHA256
73886464c924f2d3085e75846579bcf49499fe2a945e033c442cc175e7cfbfc1
-
SHA512
9dc0246231be62a767d41c8914d85034f607e8b87a4f52d3c396a041197b317ffc52a4e859be113d57f4fced170f44c030d702e04ad85ad634bc63c168612873
-
SSDEEP
1536:ryomTc8Oed8qd8Dd8id8AChi8PBHeattTYUprvL5kml8UosbojGp:Gi8PBrwU
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{199252A1-132B-11EF-BAE0-E64BF8A7A69F} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e00547ef37a7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000000f9ca5e427862dc13e961cb19f2a7369d333d4f332fca617472c60c7ab7ac593000000000e80000000020000200000005a9635c6e56ac90eea8f69cd3204471b2dff2efa160700f0477b3ef7ce2336a09000000042fd717f4d1002358a129f1a93caa43952804f07ac381778a1b536d1b44c647e26f2bec1bcea0a4f825e654cb6a07ca82c3350357b23a91e1a9dc97af17d42c91e053290d12dfbba73d816536b2247c4132eeef0e1267ab4f231840f063f3bb970d5b13058acb55878f9a6a5aae7dda903cf45f0c02c49000e1c26d32c82463c44970e5849a5dec535152c14aead000940000000e731bef4aa8b4560b6a16e209be2e6c1faa11314772ad76293993a499511e54fa89e300bb8381f1f7007aea7cbad279f78fac40f702a7b94371d8cc6237f6593 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000776a66c6ad7bd2599ebd4c4f0607a9db8b5ffbde9cf0925b1eddb5c222d025b3000000000e8000000002000020000000d2c029ddbddeec08e0a7d8938ee43328f69f1be7808bab09ba754c7bc7daf96520000000291ace6abb3317a58e2896ecd7819ad86e68269b2aaacddb0f31cc2e0cd1512a40000000e6f06deeec0f861b7ccb6a036fa1379111ad09f1b57e1de18626287a7e1730007268b7910ac66d6f5b694cc778e849f843b5cfcab2ade5bdd1ddb10d92095a10 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421987997" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1612 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1612 iexplore.exe 1612 iexplore.exe 2996 IEXPLORE.EXE 2996 IEXPLORE.EXE 2996 IEXPLORE.EXE 2996 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1612 wrote to memory of 2996 1612 iexplore.exe 28 PID 1612 wrote to memory of 2996 1612 iexplore.exe 28 PID 1612 wrote to memory of 2996 1612 iexplore.exe 28 PID 1612 wrote to memory of 2996 1612 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\491903f77c3dc29797d1b276b09f9aa6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd04c3e49586d06b7b2fe5f792825b14
SHA12b5f185ce3b2565775e86dc80be735842011946b
SHA256c35d35c8b8d6dd8fbcc63fee80816f9cd5efce9edf4483063227c2178dc34b17
SHA512dc803221467ed62857354216caec007d5c04b70182bdf12cdd7519b9fb1d4fbd8f94cf74d83c2f41958ed3a17d869a00556c1cb9607c70478b0e7ccce8df2376
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6f6d3e5a8b4164cbcd8bbcc05bafda0
SHA12b6cf831fb5420692dd9058bbe540f84df64b02d
SHA2568ee5502f0fd0f36fa505883e0b0a77a4dca01167a0af001e59f4d4e477f40484
SHA51254240987a920a4861641e20caba5bc67928e35652f304a2d9c1f76c351d733bf2ca5ae06b9bd89c015fbd13771bc2dc78b8d8e21a24ade0ed728871ee4e56877
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b4c9fd789297c9045c077d249734c5f
SHA19da8180cdff6a0e17c53f326428c3ed9baf0c5a6
SHA256d48e2e9337383ecc31a5a0604e6b468e69eca79a86f9750034396fee9c3110d0
SHA5125a11d6afe5005a8c851ae3bdfb10856fad1d22d7cb44a137f0fd7f8de1e56144e82a256061f558a6fecf6c3725e77571377607396267d904a7f4d51329434999
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f8306f923051e7209659e29503750cc
SHA165218b5327da35077849835d96ee3de85a82abe5
SHA256ab91c9c0d21c46dd8885989b72da6424bffb168242f3a7d30dda4e7528bdb32b
SHA512f2edb98326d970c20df755fc3859cda25a3bc14f55ba7c5bc3b3a1c7ddbaf8e1f1c2725424600ee8c1d939ad7902acacbac5eeb960acbbed5b1865e665a0f854
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56815b21acef60ba090d6018eee0a9c86
SHA1860ed06b7401a03f9040d4d4bb3b34c99d72d57d
SHA256118a61668e0186bc0579dd3515d9a0022a57a5743d14e93993b7c38ee27d11d2
SHA5127dc96b50c2e0fa65b681f92ae57219592573b1c40e44cb73688759c18f49bb497508ae0837fb17b02248b1e6f143258388b1f987090b8f70a1e1d815642a34a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596779c470a14c90a0f558758b6f6345f
SHA18b365d08a9beb489d52bca615b80da68851516b1
SHA256c0d95a2f77a4702471ec5aa80171a248359ac79c7d73d82402bf67b4ee2105ae
SHA512f66a1d5c71ad5af0b1a233143ce0328c7fcc60f43a16f326059fab1e450bcbd0066e02ee46b9ddfa2a6f330b40e74ef7d17058658a2dc0f7649a7fd94b89cbd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560f13a72b99f1d917f11ec01ccaeaef3
SHA121613acbd6f077889c3b400d8d2d0f877a98ddb5
SHA25644d90ebfdb52d57ad9a32769033ce6da2ba6160f95ccae4f78c5c3d95f73ce62
SHA51241e797d82d3b9ad2758f38ace611222d8714b5541cbff1fee218f381abc02e805ad9764d69ac0cb686d81dfe1f00412b5e778b96e26ccf1f5e5ff6639a49c97a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f07b847c5bbc2935dd2292f6f6dffe6
SHA192018b995859319d140b5b82bad2fa7a8d690944
SHA2560395f77155a4c420f2bcdc6b5faefe4bc344d8a17150bf66dcc5557757812846
SHA51264253efdb82b7c783cc9ad8aeb21b830ef2da1d54c01a13e6ee3b44c63903db23160e87830eb8417a2a3e74971a777bb449b672afd5b40fea7ca45f961e06eae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571bf78a70e62de0899c623b1f51e6b5f
SHA1cd1eac6ba0ef50a69a6671a7bdaf1d66e67f22d4
SHA2568cbff14b9bd1e8c9335e9b61b527b0baa0dd30ef60a14aa96409edd0cedd1548
SHA512445f22ec3d612e7ac427ccc47203f2e45380e5573f47868f0071bea5dac9c008691212b625e3cdf03bdd2f466a67702533b7809d90e1f722e052e36abb0a038d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d80adc1339b477c3ff75f1d42245c2a4
SHA1a39bb643783f10f33d2386f115591f601a749ec0
SHA256a55b7c52512e2c672c97caffb64a8595b47d1bd4617fa61e3979852083c5045a
SHA512b58a55ff5b2fc7b7d5bb3fcf668a9b0a6a4b8174f6a0bac25f4e443d78e456597363b698e940f84d4879cf410a15e6e29a417928a1e136747cdaea89be278553
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8846694660b0dd1f4b38473d62c1dba
SHA1d923074a5999928ad86594faa9fb117dc6454887
SHA2560a395cf20d1dfa99baa532d9e2a883be93644deaf49efa604a89eb5f5cec75b1
SHA5124253f37ca2dac9cf02c0509bda0802c033af8481758baf2e952b39f585587ab4ce13d7575e7cac357ee82faaa98a7ece6a3a8cfb6f522270bad29feb464d17e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d9e26b922e6f686c7f9a262664fdfd7
SHA130eebdc3c71182a3cadd1153b42a365cf2c13a8a
SHA256e50ab0ccdb280e5757a759a72e6ecb88eaa8e9ea5dd74d78cd605cfe4152ef5a
SHA512aedd795bd0edd409e9ee089485fd0440e42aac1fe865851881d7f7110d33d1123baced9c1879dfd4b8eafe31729bb73d75a3a1c3835a2303149049b1ef9207f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56782b696fb92a13ddf4f04c734bdaf5f
SHA100b5c594104ccc07e05df11d912834ebd5e0d124
SHA2562c66cdd1a7058f31564512d62b6b83864d9dc300876414602a9f7bf1bbec647e
SHA5124adbdf5e15f9ff85123f4e624c0383933207220cd9a279a9b6f1414a4322be40eee6ce60cfc65e506214383f8384c4f03b0773ca1365eb683835d8454b717679
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546f88bae8d7090f4d855cb6cedd41e1e
SHA18b620ea53876b28d90279ae39766957f799886d7
SHA2567cf6db98e8cc3985b91fa6ead2589bd43adee19c326d503de4d150395ae03a14
SHA5123edc21de41e703ac78ea93d1b829a05b1326c38d1d6d28a4c34c5679157a2794264140d9a08cf2a22a1b333cda0506bb785694a562a789eb0e47b9f5e210bd66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db84e49f59b859fd3e667b9a0baa9e82
SHA1032891807fe1198e6d2c164a55502f8bb72cb64b
SHA25690866325ed7e9c3444063ed2b7995a302b7346c55f0556ba2ecd0a7d93c8f191
SHA5127fbfa49ddb19816cdf75a005e3f91a78de30278dc86344a6824f0bc1d32378c9c3111ac4fb4777a81a77411eae4ba9ae5da9825aa36b6904a07fb6aed0a4b206
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5579ace2403046246d18116faa7314e5c
SHA1bffc1abb78d5ff31b4c3aa2a8f01ff2c28e48b51
SHA256bb5824a9a48b3d73faf3bc0d01d72acb66eeaba3cda5f84b105670e0a9f18b3a
SHA512ab78be017e13249a0cbba5f79ec828ba965623a24179d66e09ba70e838d023cd7c653344df1f1abd6ae7d1c186868476968e49b3e54498a559a38c4ee49bcdb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c1adb88d62d9ffd6453bb6755fe4347
SHA124ec844996b24999844f8c030f7e822d69e10c04
SHA25639a8ee913b63153937af5a7a03b5379f5aa52c30a0338c5f91bb5f3065852418
SHA51244689351d5572b4b0570d533008c7259ae8fc076a57ef4c3e6f38c4da02ad83cbf1c1af3bd2e7c5ebe73eab5d56e3d77c68f0cf79417f112c93b1fbe00c97ebe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e56e4736f1862406a7950d49871bf28a
SHA1bd97a39171f4273e157f7c7c7192f7bd3c765e0e
SHA25627b7354ee768f171f226e85fa42b1986189947e2a8ae13b2c354687ade2190f9
SHA512164eebd28825327ae90b8d7c7440b415982670b053769b12678afa78593a89f8bc18d038d556ea4df6b09076c86e550ef87672403e32a195a1fa58becba34b75
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a