Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 13:35
Static task
static1
Behavioral task
behavioral1
Sample
4b54714f0feed315a1891cf2ab752ebd_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4b54714f0feed315a1891cf2ab752ebd_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
4b54714f0feed315a1891cf2ab752ebd_JaffaCakes118.html
-
Size
136KB
-
MD5
4b54714f0feed315a1891cf2ab752ebd
-
SHA1
34b0a67e7a2374faf7cb0c114741116112c8d01e
-
SHA256
d55a4cc5947d8111446e0aca46998ea5b03bbe446a1078000859127353178a4f
-
SHA512
f6560b73c6cc533ce45c8f5022a04fdd8de8f253e00582c023be134a48de3fbec3e90746bf37f6e2afecd41b73f1f9d61513645c7dc46be0851005ad970799fc
-
SSDEEP
1536:SZkaY9FwOq9YABCTS9OBH7MveOruoqysF2yLi+rffMxqNisaQx4V5roEIfGJZN8V:SZ9yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000ccb4b78df20715488c2b3aa0ff9d5c3a382c1eaeadce6aea60866e5062c1ad83000000000e80000000020000200000004a0295616fbdc87e87483b30143c09216dc1a86f0b2654e2d2d7154fa7bba7f090000000972b792489ac94a7381e04e6637715c6f01e2443c1aa52f8b573a84919fff41af0d48fccd9423a746923a34a609e9ce56109c95b7bdcabe98e096412121788d4b82bf6738499930150c4f1f33eff96cef7efc3a2680330f24e33dacaae52fc9d032bcc25e1e564d092e8d2aa62e26b8699368926b24cc5516179d923e8e3ea0491de4faa3a194736249cb88ef0768cef4000000091a368ced816cd15b41c4471a512536fa5f8022a990c381442ac510592cee7d170b4d2685be198fac1f33657243be89a55366481982649692e3d7717d207bacb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000cd7407d555bf32bee4795e134f031eb5c317fa571ca797daf4cdc8815992e383000000000e8000000002000020000000d00d23bbd9eb2311e60be69ca59383bea0a25e556d956ae682e1631bdd937137200000003bc8e6001e253dcf3e10f0a26a705e7c55faf3ffe8502e3e20213fcb8d88b3e34000000031797fc08334b82cd676ec20e4f155a2efb3c2c42494af36c83dfe0be6d89d4cee7011c8792c814905c98720403603abe3ac31c0a4ae03341b0ad38a6cb517bf iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1E62A7E1-1389-11EF-BEEC-D20227E6D795} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c01ad7f295a7da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422028378" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1924 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1924 iexplore.exe 1924 iexplore.exe 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2916 1924 iexplore.exe 28 PID 1924 wrote to memory of 2916 1924 iexplore.exe 28 PID 1924 wrote to memory of 2916 1924 iexplore.exe 28 PID 1924 wrote to memory of 2916 1924 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b54714f0feed315a1891cf2ab752ebd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bf707c4c5e993fb08333b8d476326fc
SHA125f5ec4bd76101ea1e9852a130a66f1a2b594257
SHA25638052d6cfe838a31c3d3912fb8a47b0cfd322cdbcacc7a7cc0da3fb2f1836e90
SHA512667043629785554adc15cd174be44ed51eb1103c5d6d6d446571eaaa4fd4f0389903a5ae99900579364d8467a21c9fdad160093c819b49853a4f9df09b56f644
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52081f51014c43b2215dd3f61fd25298e
SHA15041aab174e025d5f56678d91b21b890fb70dcb5
SHA2568c434a02c9e1e0edd950b9f24d85c60074ed86235ff0d7dd0bc8b1a84d9e6a3a
SHA5124f1e1f8120ad1ef5d831e582a2402673612f642f464aa12ed3255d2ea97c2805fc8c6b54a543a93c2776923fe5e2a4490d2d4e8723a6d6a55eaeaa73021fe73d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd4435e670addbd19bcea2ff7f541d65
SHA167785d95bbecceddebb90d5cf507ad1cdefc8981
SHA256d1ee3e98c0b425f394737ea1f32694d0e668afd588163789a1e257637b0703ee
SHA512721def979c1041870b4166a705294c01e9b8426264a42c80c4869f8e47e6a5aaa88f12fb077bca6534216d9bd3f72c1c3c323a09324d596437873ebaa8a8d7b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503bc2ea18b2ed34ab8104d23800bd1d5
SHA1f69a9240357bab74980affa2778d44eca6a0f684
SHA25690674cd1696ea463fab32a610a71a010b636c98d6d453e95d650a341d2dbdfdf
SHA5124cea0fc6830104af1b3411aec4cea519b42cbab6679e34e3c74ab88b6a43ed6b5d97db8ef629b23b64a3a7b64df191c6379eda885e483725de28d1433f8b33d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598ac4a340869250d0cab7a77681d239f
SHA12c51903623453a9257570afd8b214a30c892a756
SHA256e3c310b892d83d5d401541da35dbbadb056c96f34654b344bff829fdfe941986
SHA512d4ef4fecca9102954b740c875a72ac9253bc8da717cccca75dcbd5fa1667728dabf9cf37f3f732d6730a921b8289cc6a31b80d7368048aefe8240fd754af36ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c2c831a310cee00f543e381043b41d2
SHA1fb049b0bb3fc0d75c2896d55ed2ec86197b1162b
SHA2568f5958c5ef31fd24594ff0676bf4b48de6756e2ba80405660c3d27c8c095864b
SHA5123fda4f0f6d622b2e1101fcba467cb0a53a839cd6aba0a0f1b9dbec6c319a1150a15db99cc45bd7ba03a011b879052bc270625b8e6c49f1c7d9b894c4734d1f0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f410b4915f792f4c1582805492815b53
SHA1e89ab129f8b054740cf0ff61da39db2e65885a15
SHA256516773092bb9d9d669e870e7ac81ffece7173925cde4e695864ce1d8b3caec26
SHA512e03082d84abb5070f31991f55709a65df3c7f9168efef9e703bcf617164888c29010285b6798478d4d8933dd43588d6c849e8bc463083c1499d07cd68b48682c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5710543bbfa26f2e7613f7024b8ec58e2
SHA1e5bf50907d6a0985f69b343571e936e3bc88ac56
SHA256cca7f964579b25423ed8248dda4ec75f82226077f3df186f0cffbc34ce0edb09
SHA51243a7ef66d3f56aa61b2cf55b5a5d9a89adfff463983152df96cb59e04c1e3bfb364be10ce603f13a9b94a491d0803689594baa18ea80fe0811d24a466e967422
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547d904b2d459f70a200c8d87431b4b63
SHA1db7bbdf78781c3e4a2d9e441b0c0803fa9f80306
SHA256af7fee76db3517eb06f03cfd9df34fbe7eae90547a153756b6d85b2d61349b56
SHA512b3205bcd204d2626f9cf84f43aabf34ba28c08a526c43e780587f83db2532916df71d980945474b06538bc747a59ddbb5654dcf665776ec23bf64e01ef29ec07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531248de86674fda5af79406d41dbcfa2
SHA1a6a7bef4539756c6c7a72bfb43254cdf877beec1
SHA256bee0604a062929bc124eca54a0763f7cf1ddd31be093c9c08cf5c8fcab4bc73c
SHA5120ca84264a306bbb122ba831190c7b1697521df1df2e090664f40dfc9a4af6961b6d23973ef3893795bdf9dc05ee21a83c037f0de6c5de86101b02810afd98287
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54380bf0b9470f2ce8548704ebbc8273e
SHA106e820b404ed5797385791a3ca10d8e07744c545
SHA2561546283f16c40d6c2f97c92dffc5d3b6c54048a44ca7424fbe1f03e8fc027a03
SHA5124001f7df8492f1c15d1f7b04bb2537fdf28202f418f07d4582724c9d3d8c05aeb06addcd0dc25313a09ac421efe87d7613e11ee986c0cbab6fd9031f804000d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593b186f5bde00f891144a63e44166ec8
SHA1f9273fbd91eb8d94cef8e4dc9480f67417f92be6
SHA2563a282af209e935e6218ab06e7a23b67fbfc2fd77fd0b1093f8c26f50ba272189
SHA512a1b26edee39b52606819165bdf52927354573e12c2c3ed27ba58e1357a443ec299ca7bc7aecb7834a502a82fda440acc7d0eed14afd0abd9702e0650ef1ab4e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5015b73e77d3dd4a6b212fae861f58de3
SHA116214a773ed2be7c305d6362751e39fb1639dcd2
SHA25683ff62513d51d36bd26dff24674fd1387bde9b849a041f44c9366b24751388e9
SHA51205569770dbef6fc1371a9a02cae9183ff10575d9b74cd953eefbe44c2627f92d88ceb6f26aa98e38c23b6913ea3753da1407e68c2ba78cabbacec7fc2e227537
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b26f591b2cb86c3c25f6b003a0347fdc
SHA1ed717ad9871b4b132b220ff361443a4e9fde6faa
SHA256ef2d24435f53993d90e34f36307bef9deaea66fbe2f74f6001ba4a2c3efbb921
SHA5123f44245bc1d2c760c7558966ae9d55681257983c7ebaaeeec1d7448fbb40ee89edd2597833c2d81614fab737a32e90d466c2ad0f3a927234a86b51f15317b991
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a892d3c18f7e58711fde2dbb1052b3c
SHA1b1d6b4f5c0456e929ddb182ae6f6cb36ac407bc7
SHA256a271e61f8b883225c58dc934e1ffa7ff02a989cb8deeacd4d06997dc6a87f88d
SHA512aa3ce6cc260bb751502f2e67219fc9fde35c309137cde3efd04816e921f67c2070cbcb9126a550dae132037dd424a38f9839ec1c3e20738a4bb2e4785850ca6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594b7595c07e1afb9af43ae237620f156
SHA1082b0a2e4396335730f294c45b0085620aab1245
SHA256f81664eb37a2f25334ef8a5d6b2b6f78dda80b3fdb9478c9721abde570986533
SHA512db7cab282037fb76e5349a1e8b4141e8e87b841b902663bf345f8320b6d44d1762b51f5bb95261161d3f83c68142b90c5d6c7e9df854db70a61c2c9d7ac4bf00
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a