Analysis
-
max time kernel
136s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 20:43
Static task
static1
Behavioral task
behavioral1
Sample
516640e70f1dbbd63edfca7d93f54e70_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
516640e70f1dbbd63edfca7d93f54e70_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
516640e70f1dbbd63edfca7d93f54e70_JaffaCakes118.html
-
Size
27KB
-
MD5
516640e70f1dbbd63edfca7d93f54e70
-
SHA1
b075993c14d0f34b6ecb06cc121e5afb143fe010
-
SHA256
35252fecc8cf859a03653af0dd73c34754126a50af6203db1a68aeb01dbc1bf0
-
SHA512
bf0ce2ee7055d9727619f578cf58e4fe03683df0a654d0489a0c60f45a20192b56a4207cd8690a7e44020d9da2298e44959eb8493119066b123db2ddaaafe9f5
-
SSDEEP
384:CZ/uat6oPKxPdNQjEE5GacQ/dwpt2qchlftkJT9raKTaiDiqtjdC5OL4WBSJSblk:5KK/Nw
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422140456" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5096b3e69aa8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000016e9bfc5959c58eed5b8a0461ae3f69812401bb017c5d94c0e4637ca6c1e1ae8000000000e8000000002000020000000e658ed31a20318760ab568adcf3d58450cd447d3fdcc0a1c379ac071057763472000000008af4ab223c755b4e6dd3beda205d97153e7c3d4dc0c9122b59e5c7dea45cf0d40000000d622e74581282682533523ae51b709667e9fac46699652557174252ca23f28387379b720d8c1a82373a4142e25a81dc4000ec7532f0ee4b45137a3b51e94698d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000002611cb7b2dbfabdb674a4f59140415a5fa0332b2432f9d6a1565b2a5fc100ed6000000000e8000000002000020000000da93f29a6019cf52b5efb76875a29748f8a4ef2e7dda4f36b9c663f6de4bd9c990000000cc62e6063bf1f670206b4224e7193e7bcb2bf314bceba3bba20718fed212aac31f919c2bdbc3e089cbe977a3b08547ff9ab729f9a9ac36fec6f583278f24999bd7500893f0ed66e664097f33d9256788d2f8964dcdc88ef959916e29fad2d4d7486b90dca269aa57c8bbca163d06d3234cecc16e0bef7f031a0fc01d85fabbeb71a96f9c45527dbbf15b904ca4ed83c44000000046d7752d807051b33c0e70a2d98862dd80398872930a810c234694f2b932c8b3f092e90faf12bd8e4c0641f0a6868bf069865f02abf61870ef2536c3a2817eb5 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{10F749C1-148E-11EF-9F3E-D2EFD46A7D0E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2856 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1664 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1664 iexplore.exe 1664 iexplore.exe 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1664 wrote to memory of 2856 1664 iexplore.exe 28 PID 1664 wrote to memory of 2856 1664 iexplore.exe 28 PID 1664 wrote to memory of 2856 1664 iexplore.exe 28 PID 1664 wrote to memory of 2856 1664 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\516640e70f1dbbd63edfca7d93f54e70_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1664 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2856
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bce0a873a452141f7d334478339707e
SHA17af817c0f9e29a555f5e1018ed7657909b57259f
SHA256f617f0be12503aa258f16f5cc60f5eb8726ea14b69745e7d96139c256fba988e
SHA5120d7df13392b1b34b095c08e3626479fd4e16e444dcbdcf77c1c5776211d470a93bd876ef980b092049ab8f212c1d7c5903fbba6a4ff4d886c8f5d66041f6ce64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cb10b07fdf50dc44ce5190436321fd4
SHA1cc77b8ad4088c7489167ec70c81cac050ba1a827
SHA25612813a553aa436e75e4f3ac8bec455e9167c71da7467cfaf752e1ef0a8dc262e
SHA5120cc13b5730808bcce50db824e77ccd01a32fc4a07ad90896c021df63c81137e6df7fcbbdb8925104f2a4f8eb0abd6df9148367a513bdc76ce278349163d623ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5584a99b9de5105869b96103b4b91919c
SHA1bda4d79473a7ca298bc64ed3a3bb77e344bdc13c
SHA25625f616df930b5ba13c6e55013674b51bbbd9846db64bb0564bb9cbf707972354
SHA51238ddda408b5fccb79e46f52c6586f78f6126d78e330bd1c92ac8e3e8674ca9b627db42c044d5de4abcf2670cc395e7636f8e8e34912525a0d531a670b7010697
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528f03fcdf291e436b75dc3b9644a0dfc
SHA19513ef56f8f05b596ce931cefef8ebf051f2bf3a
SHA2566563d2eb27192716a931c67cc4b53e8fbb2872d1ebdf9f1b9d5c60a6f0411ae9
SHA512cdb2f20c867ccfc73c392dc820990a7b2525308563f4035da8ad939e1559b7a07f0ed03d3de7b2597005cf2ba0ad6402a318a6a20069db1d82e48af1a414a207
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d2138b1ec11fe523d26c997f9a5f192
SHA19a43996f59532a8588f5e79a3c79d56130c9e9c7
SHA256c4aa201bd0670d81f06831888d57d86990c1e877355aa6bfedc24320377daea5
SHA512bfb0faf7c715445199ec4966c31c905da5efd3ef959b00eaa7d486c5c0618c32fa9e94702e24357e3487aaf88734954fb876f18c7edae1138e2a07afe71be81a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5787f981f2332af98b2246c152ebf0aeb
SHA1d73dc6a0992a3be18d2b70523ae8fa64ae6d1939
SHA256c3e6dc8a3fadebc9cf95f620c1a3d22285bb82b0054dc8c4fab65c0a3e094cb7
SHA512bd01165afc9954503ea1624795a30ba8e3eea92f1d7b005d07d7096d3201b1a827daef14d2378e7692976c317f849d64717d5331fafd51afd62f1761654eac9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf5a9dbcf4de80e786023cf8849f8208
SHA13e9e241ebdfc5105ca9881a89920458335ff3b92
SHA2562392eadad5bd8567039b99ba6a9a21b8140bfe4da594240e620971dab6d2d99e
SHA51243036a55cd57c4646e333d4671065f056439014fe4d833502d3fad1bb624b341a5921c130827a773a3f3ac1ba72dd1492daff96293e0695637605d16e3b07cbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc1248ccc77c57c5c977560c1f9ced93
SHA11ed7ce9a60c0f3529385a032d32af400e943559f
SHA256da78d29a8bc79ff38ddc86806643d655c7809f8a32bbbbdf50951baba8cf6a76
SHA51237541a2d162ae597dda5fa64628c1564270d5c4deedd15ff2b709026cf180fb50f005dccb5df1f64013e193b2fd522190c1ffa588b8c730e4349b158def52d1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe6aace45f87bb2f158c8c340a55eb4f
SHA13c397d8e7c17bf5cbcf2d4032c76e1c0591a0f6f
SHA256a3b93e86eca70f0d93ff77631acf630933866a0ef45067f795c2e61b37abde04
SHA512e488abf18a75cbe744adf5fb0051bbe10089531d6b0bf74718a166115ce2b85c09504c4c8c62f501231b3b619430375a73721abbed45e76a6bbe3f0b8a04c65f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b4ed950cce8b3acb36dcf3123a0fb8a
SHA18a9a2e1f01ac5354b04abd647c37b5a86aa1de4f
SHA2560689f3b38d9c9e86dbae0916d55c934622fae7c9a4f2ee940404bec0b58a88af
SHA51253fd6354358cefe3da37e372889dd4e1e7ef33da1f1c4b698dc22a9e1c6bd74f172ec7567a6f9ca91acc0a3b52c0c114e6809ac365047325bea412ffb8953592
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fec3f8feaa7f23dd095b15038321274
SHA1f5d51a24b60f20d1adcf2a994c28ad00f6236aca
SHA2562a0fac0041a7ab37fed0406e4c522f26a949fc3311b63a8d5998f99eee1c902e
SHA512a24a60a215d42440603de85939e412004055b7cc257eac4105bff6c52fcc52bb805d3db1d00eef2e4177bd6f58f53803a03870264f909717143c235482bead7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad01f119abdae390f81595c08556ec4b
SHA1d253f28490eb160dfa136a2529bf7b39e311c4e5
SHA256a834f25ecec0f048efd1f245ab35903f13300cc6b6c35a0c986deb55ff349b5a
SHA51287e680cbba4b58a33d3530a4ba882bc8da0a91ca8c141f6df755d840f274d57e4c1f7958a24d6ec308542e07295c2a461a5e7492a968b0ef7919834717df8706
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55dce5370a375e1a60b8698b58058d6e7
SHA1adf2a8dd8c115ac8ed6c69ac17bd66d9fa1f3d6d
SHA256433c2c9f52e74f39d7305bc73c775d5220735b436bc4fb9b5ba2cc2c716763c8
SHA5123595ca76b65c7b11f07f5ae34141be907c31fd27dd719d4cacbca373a65c5d664cc12862f312aaa4dd423763cb391e30aa4b279d4ec83d770e2409ed40607bf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5643f14a12e8c6d4002ae6a3390182154
SHA111f03177e0a0289d8a3a3b3aaf0fc1d2123f8605
SHA256b290483a4dea5566999e98d67582e1ed6a40a8a879f665766a808d69cd310de5
SHA512a066b930c8d428aa785c7e3433a998227e28fd3d40989a7f7ff1a537bda47f406a8d84be0c08263c5d848a33d646c4830727f8a9827160068fe601460f382d21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5126ce1546b029f9d15ea7ac49fd77fec
SHA1bb9effeb786df5c6fecd0ef958690c5dad37f816
SHA256b94aa4f1c681f1149b3bc0d4d32ec4143a0369c712d2518eabb0c91b08c9e920
SHA512eea8d945f93417420fe331e38df2945183df154fba2374a3373ccb4eadae244b036a38715b9cfbbb8d2a11ec068724b1f370e0d4f8a0fb5373e8ab87b4c05edb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b0d6237d414025f239427622afb6a40
SHA18cccd634deed49be9bd2b79f76834e07af42cf33
SHA256d5aecd89b44e34ef3f778cfa37e1335e44fee77e71953f315c14b7dc712b0318
SHA512175ff67d0a838e8fb0d0e09165a493566875499238eccaaa7f92be8164f3a42b608ec0e07a3ac808905e1e74d6c904e2e18175f6d84d93556398178f22783235
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ad751b1410774732ef72e4100ae26de
SHA1bdb52bae2ef8c73a4b2ca5ad4966bb82fb8c7d0b
SHA256f3754f12d06b8164174f7c64689e42d1ac51b653cf4745f78132e7b59159c864
SHA5124bec805ce4af6985204983189f4d556f31aa7aabb69ebfb66386aa62291f24ebebb94f257bd4ae76b5677028272fd719b36fb4c3fd379e69857152bed24b8675
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a