Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 20:12
Static task
static1
Behavioral task
behavioral1
Sample
5b4005fb56395f2f3266ae2d3301aff3_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
5b4005fb56395f2f3266ae2d3301aff3_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5b4005fb56395f2f3266ae2d3301aff3_JaffaCakes118.html
-
Size
460KB
-
MD5
5b4005fb56395f2f3266ae2d3301aff3
-
SHA1
cf804a098f97c44df47a57d57fc95be0f0bd5df2
-
SHA256
b8612037cdd65259088ddf0d215185b44e7ff309967c1d744a048e514ae72ce2
-
SHA512
0546f0561cff4ac04de955281c73dfa4277e68ea10a2eb772eb798dfedfa8e74efc77bf7c8875cd7369d6843272a2c7f46d59b0036fb82af7b6f484cbc33040f
-
SSDEEP
6144:S5sMYod+X3oI+YesMYod+X3oI+YmsMYod+X3oI+YLsMYod+X3oI+YQ:65d+X3+5d+X3m5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 202c3cf028aada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422311406" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17A81EE1-161C-11EF-A346-76B743CBA6BC} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000007299d00b9a1310a785c5e64b4f4006d9f0158d861961608ab57c766248db8f18000000000e80000000020000200000005d5a043e8cac660f97d20095643c0676c1d28cca70e1e86928f1c1b6602206802000000009b44ea4edd60a1acf2e245eec0efcfe7b199a17a720f9eb7951cb5f8f1b5d50400000005d7d4c0d0382a72a9c0977664788aa65a265edceaf852c39b4f68fd879187a60c3dc19ba282b22866f5ad7b7d09d8bd7bedde3cbd2ce9aacad98570d25c6373d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000048c02bcf0044069a0b74fec7b1810ba2bfc5701c356a25393f6b9fa3b96614bb000000000e8000000002000020000000b09e4d027493644f99d8a5616c16aa13a125d06a30b9852ea6a37a27b508510990000000bfc82be9270084f525034f427026a0421c46d0cf21492aaf4fb1a6e4ce90bbd84ee612c8b055edd2bb1f41dbe6cadca39162371c70d63e32a6d2c6f5b9d6381bd13ba9595b7c56f1d4cea8509dc1ef621e09bafd1ddd50703628cc33ae2bb9e958e073f6537dff8134392f88ca8329a391ff507005a000e6ff3fc4a8c2f52cc434b2f6541437f7848a293ad9befba56440000000f1a844ccf570de359b06a13745c6720ad75597f0efa79682f387808e31455e7d5606ab33421b28bc63737150e3a4571d419c656d74beaba0c8c61ad024512b24 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2028 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2028 iexplore.exe 2028 iexplore.exe 2228 IEXPLORE.EXE 2228 IEXPLORE.EXE 2228 IEXPLORE.EXE 2228 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2028 wrote to memory of 2228 2028 iexplore.exe 28 PID 2028 wrote to memory of 2228 2028 iexplore.exe 28 PID 2028 wrote to memory of 2228 2028 iexplore.exe 28 PID 2028 wrote to memory of 2228 2028 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5b4005fb56395f2f3266ae2d3301aff3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2228
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4feea911907b1fb2fcd30634cf5882e
SHA16a15dfbda68eee89a11c0ad8bfab058c3cdddab6
SHA256570fb462dc5cef83e2a1518214e1213acd031408e4b0f3274af8581e982f5d33
SHA512c114cd379434a5ee8e56aef60bbd4a9f7d4e66eb765e120b9a04fb379f1ee0552f28895f8e8bc7bb6329c7dcc84e6b26fbefa26cb51eb4cee532d2099c638fed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fad50cca3403634f7d71d25cdc0eb874
SHA189d34846115628d10d69c661ca2e23f5971f5e9f
SHA25650544fb0a028e2dff85a258566689e02366c8c172d0a4941e3b3b13bbc87d982
SHA512738bd84cd85e4fcf2f667190c804f6e319775f927389ff8c0825c8e7f7f2e1e91998b16eb8f5fa2994caae7209157939cd69cc138f8b8dc90179b1eb6e826a52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a4e920a113d4f02d45601c6ffb65b99
SHA18e6f1fb9f8988aacb01134aff07eb7ee7de2445b
SHA2568dc2a13bb4bc4e0771925ffed0b4df7dc7b5b828ae05a20c0e115deeec8b6c7a
SHA5121c72beec944c692e18517ff018deee33526f70c57151079ac4d8319ab7646445b74341395432c397aed084ef9f7348e951e6fb790380dd533969e14771380b9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f94212183480ae22191785bde7740e3
SHA1efd228ba4e92816b03d80e70f3e5f1c9e42cee70
SHA25602707ded7d87717a1bdf91c82377f08a22f779fb3ebdaa321c95ebeb5be62d71
SHA512b24a0b0f922ef55373af2379e532698e58d8fdb11132f98156f9d9788ce496b8ed7e24267d904269517d5777fa7483f37127a132f39267fa03d971ea9a9a56b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad6c8145730c0bcd6665929cb80d73b0
SHA12903dd122a06f0c17b4f4f49b04a452463b54af9
SHA2566b2eb2c8b95065532b2f93f0ccbb3e8af0fa552d1b2c359af123056fd97387a2
SHA512a49279a525b16f2ec8f36c8c8e76034313da702258174b0325d8d65c49efa4928ea669910902e7ab4efec93e6ffdca3e6274b75df11c3bfc3fff15fcd0b3eee9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dac9057986a943380b7ba7484d9587e3
SHA1cddffce39da1591a16fd6b1d5b7f042b36e147ba
SHA256e5c1c4c8d7fafea227c96297e7ce965e1ee93fe4186e3e0fa82a67757ea508ca
SHA5127467923242c1b194653c880ffff568fa894d4a77d4b466e25dd9cad0900101ac152524826c386fb0f92ed55f5493991610394d111e43792d71a00ab547d13aed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f38d9ce8615c0ea4ecaa255c9b06b892
SHA1f63b9981a3ccf2524c75400df7fbf4113ca21f67
SHA256b7797542d701d4bff3b5bc04843d0c63e9a223e7fcb8eb63925cc241877b6a11
SHA512964ad4e6103bc13250e357d0092fe482c94b59c5073df212e16f32940e2da6c63eb15b700bedb91daa5e20880ffdecce9fc17ef0f2ac5bd814b1456117a8bad0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba6d18b0f72209c37ee5761c5a36c85a
SHA13f19e67ebe1d7f09050b5ab408dfa2ae6cb3a4f1
SHA2561d38c9a3f3718fbb17161f51276dda4fda1e7c4de7108fda07c7bd467a3ffde2
SHA512c007e12e686f8b382a38b5a3fb55df0ba612783a9d62ed8df2dbd60e80057ba40b28eb15343bb7f2fcb08746ebc3d409e49ef4edbf9af86c29ccdbefec5e4125
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5412800e24555dc29720f8cf68f3468af
SHA1dbbe30216d98ff16af0ce22a4546ac062dadfa5b
SHA256b04c1e0b06aba21385bd6b323761fd606f4882c579ef794db9df2dbc6a3c450c
SHA5129124f4b605af87403620dc7b9280d76860454dc1563e878b5a6d911055fd797ccca8d9395687a49b62bee131bd8a577eb0274e73c393c011940c6fa4ae9a7760
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578f12733b666383d49cf00e727dd227d
SHA1a4dcad0f0baf1c856060c95806b91d4d770626b0
SHA2567055bd449e69090fc2781d5727b81820d80e02a583365b6a15aa8a05529b9285
SHA51289a41d4bc0667863044a16ae5f00a796bd6eef689c50b07333f18744fad25c56f85fbb0cbb0428e0c17418c73b4de64d91c68e244e22a4003ed020f9c9f9296e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e814624133cc420bf3c6592dd23f9e1
SHA1075cb4d0f97bdafe7170d089c117496fa6416cae
SHA256c4195841463f5195153ef81d8a8cf57020a04c22feb98d655063c4754e265d90
SHA51242b02e436fbf95d53d0b75404cf8c345378be86708aa7250808d87c373e1940d393f4c63b8f75d33dd24260d2beac07f79cdc49d3f49609fddfd5485f09547db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f85a8c4116b59554e9a62e6b69590c01
SHA1bb06fb42449938509b48fd259057abbcd18dad94
SHA25694886bd12eb16ed3f86544ffc6e4f9e7b85e2ef0e558cdc7fccd02553575b3d1
SHA51258c7d5b5c4830c5eddb832ca58015cb8cc20cab5fc004948e60ba1efc25371bbb14d97137f4c6acacb9129948af0c2d1d5ff0b5f17c14f2c2f65f65b016e8a28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc8fe1ec9be8de05b52b2a5f7c6243c1
SHA12472c505a3b3ae12afae0ad07911514064ef7d82
SHA256b92ed26c162f9e581b92c231749de92ad380c4abcbf52c6bd7a34c195f096bb4
SHA512597bfcce2ad08ed146dddafda959d4911d91596464bb2372736bce61e4fb9562a5e444438bd09a4b2da100a23faac73ed52f05ba62f875a3c1989b6898781526
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc05d88a595c65841dd15543133868ff
SHA1d192b9a54314bbdb2edffa0c52ad77ece46a4261
SHA256a83cc220544b06429a3a267d1659ce98812f138f44e5d38698754aa2a85df961
SHA51281913fffb21c944550909990932c18c191a1b88e202f6cfbd6e1210729a687101f33ca998f044b769334ee2bdd9fb9ebe9f1ef4957dcb7cd2e38ea870e2494b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bada1d9b526c1b980c7d2667d4bb18bb
SHA16839722d0b785a815fe37f42bc0295e0a70ec8c0
SHA256f6b04164fa204aefb8f16132eca86e4a6a49e8e10bb3a1a85589e9495fb227fd
SHA512c608592a8ee873bea555038571af054588f58a7243a46ef743fe756e18e6ae59907ee304f97c97cebbe4ec6311b27546435bae306678a0c3f88ef3a062a193f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cab0930474265259031aa96d75d13ad
SHA13ce30f0857f67927693203aab62768c930b8981f
SHA256bab57c7e7865cbef3b5a8829c155ef200a7d22ebd175e09add8878bab5b84435
SHA5123d9a3e4ca7594bbc7f4e5519920370964e3f57cdc845d5f786a210389eaa927b01b029582a219ca782c8af9fe9094e723d11dad802bf04de9fd98f78596ff38e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3487d8f5df223502f3b34346f54fe28
SHA1b84634342c717d44179746592161d517e9a2c4b4
SHA2562169d289caab7b30f2ed0fc6375f272e3fcff8f77533bb3139beab1e61dce76a
SHA51261b56274d80da3363d2c3ca3a2dca40d788c0780fcac983a30955e229716092de736ede776df1ec93918c7821805d1ceba8ce265b190e8f3ea2a6535f5076b16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7291ba901e2a9b6d599d3e05658d574
SHA1dcb6cf4609658be74f851d944c45c9da058cef9d
SHA2567b65d8c853c15257a76ac1f5c737eeb9cb6057d8f58d66eaa45506b6febb3516
SHA5126521beec6b29d5b2cba74aaf95a4fa197011c029cb9a22cfd7ea8451974453a3534f3896d050744783981d389cd02f9946178a449aa721d80c5c22e92a91044a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55bedc0116c90eb568374e06da0c18222
SHA1157e383a2689ba2a716fb57427909d2aad4ace6a
SHA256da00c7570858bf1b5927fa9033303f2228bf13790d700fa3e6c62160b9f5ab73
SHA5124631b4a24ed39d5e9ae370c19b513b297b4d538dad04b5ead8e4d5b17bf72033e05e2ecdd90df2b49ff345bb6f5f1cffadd42e9aabe55ef5eade05ead0e69616
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a