Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 19:23
Static task
static1
Behavioral task
behavioral1
Sample
4cafbbf0f902d2f770d1c104d210814f_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4cafbbf0f902d2f770d1c104d210814f_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4cafbbf0f902d2f770d1c104d210814f_JaffaCakes118.html
-
Size
24KB
-
MD5
4cafbbf0f902d2f770d1c104d210814f
-
SHA1
1e027698d25ffc6e1ad95c63f383bb824a892dd4
-
SHA256
32f5fcbda81bb19f8729310ddcb8b4496906c1c971982ccf0c9de96808561b41
-
SHA512
0186ae9a8e3cd3950725e1b7db2b597679c982f4ed7fe80492bcbe1dea9e337983611d6bac66c119d8998a92ab6a2ebf3283129b55e9e82e6049426ab447de96
-
SSDEEP
384:/X6qUVkczFiX4pmOdOiuoNo9oD0Vpt2D58tAYsNNfkeo8BYU1keiD:/lUpzFiX2XAt26thleofL/D
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000ccff6b8ecbeb8db7df9bbf85275ff61da4eccd55ed7a054fbee7985e22d0644b000000000e800000000200002000000081a47c26d9d58caf54574802b1d1e5101b80869d740c0da5b513f3b11d057a1f2000000001c61fc770940925d5a4d24499fee9ac04bb66158c9cce4af00a1e9fc6dbd7fe400000001c561d837fded8bcaa60a9fbf6bcf5fe206a56d3dac332a5a30d46a6aaadd2bd9a97111d7e774b6df26a43115d684a9d15ffc4c022739b879db313bc0725fa56 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000fd2cacd8b6463eefbb62c85e241b739533c4337fe0203cbe0ff7f3d498488fdc000000000e80000000020000200000001420b0b42932ba631c9033128b3241ef76de53d8445802509912c3d1bba60f819000000038c4a502148e24aeaa6107f380b4ee1053729e23ddd6fa1d3423af6458d28b4e49150b6f5108de4f9b5fe15500b3ab24c851dfb8eeeeb4fbd193262b55741e7cffdc8092456ac299632871f50f72e3ef3774b8293db88425c3f73ff173e7a130b282a21a1d6fe587db612dda648404ebd213c913ecfb3653dc62ec20d5150ee22de3baceda7ce1c3cbf30cc72701301e400000006a1a0f2d2984f3752df8a163ad580148203e3b46db4114e0495eb3a1c2737535b36f60e7f99a4b19a9dbec0a9f78dcc53905c15d4cba53f1da734753a9b9be54 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422049310" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0023d9aec6a7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA3FC301-13B9-11EF-BC3A-56D57A935C49} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1956 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1956 iexplore.exe 1956 iexplore.exe 2960 IEXPLORE.EXE 2960 IEXPLORE.EXE 2960 IEXPLORE.EXE 2960 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1956 wrote to memory of 2960 1956 iexplore.exe 28 PID 1956 wrote to memory of 2960 1956 iexplore.exe 28 PID 1956 wrote to memory of 2960 1956 iexplore.exe 28 PID 1956 wrote to memory of 2960 1956 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4cafbbf0f902d2f770d1c104d210814f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2960
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582d831b05fed26aa894e00b4176aa47b
SHA1f247ce193cb9ac21429e8f438f51468c01e1196d
SHA256740170d25a6e1acd44308de2f1bbc90bbfa83da94fc01bcbcbbf6b41c9d19c43
SHA5120b7286c00801965816edb2f4d8ebe9375cf02e443a3f5e97a3feff4f44b19c1d25090064360731047f83922717ed962c2b0946b2083afdca0cd3e115811b3321
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4c733bfe782a2814971d199467f522f
SHA15563662fafaff8024eaa834442207ff07e9734bd
SHA2563f824d1b1ef93ad7a1df4f91d148462d6d3c1df2f97313fbf09ed625a39fc747
SHA5126623e2a2fe47c31719e272956ac1fe5e4532fa522c44b12b3d546867451a0d16c4abd61cd0e1be97ae6ad7d7376325e377201a642443af8ccef23ae5746cb330
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595ffbac24b9b829f22ef84d410fe3390
SHA11a054b4ad0043e53e069e08eeb386c8bdf66d412
SHA25670903b06857163689801ae84d97b47ff0cb85dcbdc949b1a5f8c90f7bc31cbba
SHA512ab4bd2dc5a098ef354265318c7df169cc84ebd9d03c6805a77957fcd023a1a959a6568cb1b763a5d486e284f4a32ad382f946e8230f99454a59f7e9985a6c53b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5880a307ce4566b443db55690915880d1
SHA16d52ec823c55d1f1ce8c15b219f19e336df412aa
SHA256b5b48b6cd576c0d11a76c37d21265f7134107c3f1afdbbbe8621c7c34668881e
SHA5127f6f86e69e9d12e589f7862d2f993e513f2a1c35bc673cef85f034db290965fd7ca992fff4bea7a700cc148103bf262798707112345b9893e8569479aba8de86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c607bf1b5bdb6e5a24079d6bb6ad973f
SHA1a41f3b80b953a463749e42a49ea36169a70c788a
SHA256737b8e4df13fc50cbb70c9c821bfc6cdcd236ce41a5860ad81d3611e2bca97a8
SHA51265958031271020d862c335190e84d33b203289f4d9b59e6cb7cc11d0091a157d5984dcbf517cddc968f63d7022c5e45858c67d9f55ae0070a4f29e2dce72e2aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dee437e6642568109d84f94578ddc7c9
SHA128e8f1749ac40a81a9464340dd603234236b5f51
SHA25647fb58260ffe7decef9425be478012930415ae2e5a5223dcd4dc116701a35eb8
SHA5121400ad9205fb43e6c93b4930d094cdd692237d704eee607fe8aec66c82bae968bd67cfd2894609656eb31fdde67685c95de98e8c0c5d7770ca3e93747dc4f9b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569c20982cb1a33d1a323e74732480f76
SHA1d63fea481b1070a972041d1792fcea233729b457
SHA2563d7b92a737ab9b9b8e5624d7d32f2434c7e172a0d5d4d59b145817dbe7e11e42
SHA5125827f47960bf7e76e83686e84732518c9ac9decdbc104c138ab6de0b8691efbb15d5a35259f7d30c756ce125eb92734269b2991ce00efb7572066dd3026aac5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509f403f7be047a4ac27afaa3e65cc518
SHA17ae6ce717e3e934e9fea8a2050057d7cdbe5f735
SHA25628bdaff80a45e1a505585ebc02126464e7feef1096967c8928f65630e95b0a61
SHA5126d8b0bb98f66988b2508ebf9d1be3d1e0b96e56386a0f568fb7c2d45953bc6d9681d752fdeca84dc580b1fad6b47c779b0da4cc121ef20f220d18719678b7c88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55481f08f12f972ef012e6d832f5eb0f8
SHA14404817c789bc51a5f19e2750ca5e8c02e14a41a
SHA256c929fd666bec901bd0d86de2a51b3f2d10c33e364fe9c184835fd8306dd00f24
SHA512d2e0f222c864c6e4d767738ec1d45f9431b9e9bbbeafca3eb0156fcbd1ff1b508be182e4f37427b79b50136542461c69c90f1754505daa0989a1acd534798b05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ebbd8d99d92a01a4ae540935b52f1e8
SHA180c1b84b396adb62091676c75e11cfa255b07bf1
SHA25698ebfd940bce9e9f09e878f25863d3d65264953b4b3dbee8fa2b13f9bce3e579
SHA5124baec1388ef0d3f4968bd4d392e5cd9e02d7882c967a87dfaf91a8df7522708cf2754693a0a5c807854ff3603cb9585c485ba8a31fcf3ec6b8c5e6519d1bd726
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b902ff3a1872cafa19728f9eb2bd3835
SHA1b754b3b00094faa0a4b4f8b76b57c7401b964865
SHA25657925df699aedc6015d050d6d43c96de36ddb1c5c39cbf9fbf006fb6730ad0f3
SHA5129576507f6aea364a8a82cacecdc9cbf1b79e60d6540b91fa1f0c2162075113b3a88ad08e014634fcb3c5e082bb4a271fa9c12fea6b0cb288a8333646aafe24e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2df8b2c4929c54291b1bcde588b9e27
SHA15665277ec97189a586247148b13dfe54f99effdd
SHA25616be0db29f38f4c4658e8d53827ab5f6b4802f0c9e08c6224fb4cce8c937afce
SHA51239b03cc1da18d35b5c86de62ae3db2b1a25895ff83321a3df3a9dd3b017109fdd915514e23fe37dcc7f3789401b2a081f0a0b22383e820ed1d5cf2e7aa4af3d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5872fc85dc06ad9eb98de5954d5ab5990
SHA18c57d54189e80d8633d6f98ca0eb5e95b1b16cef
SHA256b7f308ac85b485a6862bec6a741ad8c184c83dcb6ffb72f322519a3da03e493f
SHA512c94b579b2042cf57e5e0a7d5651ce4aa66bbee62eb2fe7b43987dcb9b6cebdd2c87c5753eb89a1bea60fc8183a4270191951960eb2452d8303ec80464ec37ea8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a05ad4a899702d32f9a40ee3c1b86abc
SHA1d2f906a3d0fc60685959e29233294924b60d7e70
SHA256e1112b8313acac7e5d847a2fe3b5af3ee6cba5838228dfb7e4e330b78ed29eaa
SHA512568eb6e826ed9bd234c2ab56f63f96fa22892a3b1eff00c24673a4733546764dfd7c443fc2b679cb5ce759f3e8b9ca1bd6fd9969b2048acef745da3b74ff60c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532cea8af895b06a5577babd07a827656
SHA1be07b51a8c7d3cd863be39b62256936dc1c77859
SHA25628736d09791ae6c851b379d886010568c7003fe977662b0ce71c63a54c597a17
SHA5120e3919796a648f7911b2fda35973284363801c4b5849311009291295777502406a17d26cb986670e25b88bd8e12d6d139b1bb1e1e41de0b937f853f77cea8bd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d21b9b70deb58f74b82e518a6054e19
SHA1b5471bce6fb79a009f91e2fe00d5752c959fd3c4
SHA256f3106db6e361d12d18d207350212648b23ee9045a7634d2a42bdcd38fdfcd5bf
SHA51273de0c29e7671c15bc904f134c50a120c75203c9af2c03f6e591bdc5dd023fb1993ecaa313bd8b1d2857c9f23241b3741dc704e56f7e00aacf580e8da99a2f2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50776c43974ec743c196b7b01d68931ad
SHA1925130e1044204b1339a0fe3a46181372527d685
SHA256cff90fb2155475f2a6fcbc06030042311b03832b48f624221835aa13dc2d6c43
SHA512ed4b91d38e4b11655cb47e564946c7c7e71cf13a428a24daecf8b7d2a33a0dbf731eebd2dea86ef8710014df42491ea4a5685ec2205a4609393ddeafaa63e4c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50775820c85251ce999ef8b3884b2d528
SHA14bfc320204283f0beef0277b7132d80c9231954f
SHA2569ff33c704c2964915ac3d8123aea7e7df0da151ac0e1dcdb3ee20631cec0fbc7
SHA51267ad04f787eab0c0b994599a6d4f33b2c7ede5ee8b6716a18a862fbae0770f12d0202ed47eb44000890a933b34121d375046f8f9f4a1671208cfa37143c73ddc
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a