Analysis
-
max time kernel
137s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 00:56
Static task
static1
Behavioral task
behavioral1
Sample
5c5c1c5f20f985bd667403b51fe861bd_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
5c5c1c5f20f985bd667403b51fe861bd_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5c5c1c5f20f985bd667403b51fe861bd_JaffaCakes118.html
-
Size
69KB
-
MD5
5c5c1c5f20f985bd667403b51fe861bd
-
SHA1
5a92c0cbcf3aa1d6960af93ba27a00928d387ee5
-
SHA256
118a2068fe040cf3feda7c1a4a3cb98de21f1dc9a38516db30e788361f6903ab
-
SHA512
94ecc98e254da34e69515b64ab8fd68565949a938e8c9d2e86c43ab69fada11dd0b28e15cd1d40270e5e70743e7f6250bd44e4cdebd2237a429b45fd8ecb8bb8
-
SSDEEP
768:Ji7gcMiR3sI2PDDnX0g6sa6uC/iDeoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFf:J3OTzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422328429" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f538c6508eb9784c898935a62319a33d00000000020000000000106600000001000020000000288ce117853a40f34104c1626f543d71108af3444ab1a2545cc7691ab77a0682000000000e80000000020000200000002588b76cc50c24ecb92790727833f4ae8c7c5291023926d06306eadb7aba5c2e90000000cf8ebfd57f05bd3a3935ca90552e95debbdd01ebdebbea6cdd7af37eb08672b620107014e460323b7c16530340048ae5342063c35abd29be4b486c80d9fd8252983a6cc24278232fbe11bd3375afabf931f9ed1b0b0ba4ba983474f53d22f58caa579354f90be46abe7f870c6f8de26f63c6d322057d01e51a3bf4646f3ce6dc6815749dfdb7ac823444d961b272bdaa40000000470a14ca034269f928f2e111dd69bd5db1c2f03d13d1683fe9b1edb7414f835dbfe20cf531ea9c8608a53bcfda7ffbaa0a67b7c48314a3c2023f26f2680573f1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f538c6508eb9784c898935a62319a33d000000000200000000001066000000010000200000004ddbd14987ce25e3bad50242c5c8e28e60db2dfa7a9121533ecabb7824a22b12000000000e800000000200002000000013f5808f88bb645de194f83f8121dc3e0754106e018e589d2dc660de378116b920000000e1df905126c2a9527d52def4267a3d9e46140e68eb220baa247a845054baeb1a400000004e094cab5c748d36b6e5e8036e1a9ca9ddb02cdb1831df078fb17697f437d73c130a1217fbb33d1c36dc4a7253b261eb8ff194d3beb25de29bef2d8da807fea8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BAB51C11-1643-11EF-80DF-F60046394256} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d08f7e9050aada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2836 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2836 iexplore.exe 2836 iexplore.exe 1564 IEXPLORE.EXE 1564 IEXPLORE.EXE 1564 IEXPLORE.EXE 1564 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2836 wrote to memory of 1564 2836 iexplore.exe 28 PID 2836 wrote to memory of 1564 2836 iexplore.exe 28 PID 2836 wrote to memory of 1564 2836 iexplore.exe 28 PID 2836 wrote to memory of 1564 2836 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c5c1c5f20f985bd667403b51fe861bd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2836 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dea60c95db7f8264a8aa8e64b1cd7ebf
SHA1aa001e48e6cad7e5a6b88849e8617e7f0f300cee
SHA256805cee28c180f83ce8cc03d076bd48aae5bf0072e413c3684863e6b78edc7952
SHA51295031ed7de500f273a38c18972d7e25eece7ab1d413db118a3961b0c58f837cb6956afa7e3532a56fd6e1656ae30cbe2ce5328226d8b60171eafc70944d14425
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b13fc7d2f73cdf1c66b293c1cac278a
SHA17ad646baac18b09f7c56496f9731940662a5ef9e
SHA256041387df3429ff656a8968d1033ac44ce848d6348a70f937a684b24759a8b4c3
SHA5125d215717531da2563840b107cc260cf476660a2e353fb58697b388493e6c4d07b247f87f6057c1aa46b9302a9a911db6725138d70139ae596137b7095addae47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f567590b744504d9747cd5bd02f833ef
SHA1e89410cb69c6868684080ec02224476f1c96978f
SHA25663914c8a0b4af68cd1a27eb8696aa38827ff9f253d4309b117967dedcffe7514
SHA51226226163763dc70c060b93dd82435de2d9282a8b086d067added80f9860d4a0e23328a597b9718abb104bb11d4b420a35ab1608ed0222725a2bb4abf420ea008
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f989e664190f8080554f8288f001bb50
SHA122e04dc9aaad645d6d6291d735eb649588babcbc
SHA2560602988b562b49655f763ddb58c294edbb0b111becfb3789c0c11603e9d57745
SHA512a872a6c01f43ec67cbdbb5d39ea5dcf218f1d1b475614390f3faf10c0443c74c498c8dcda01c3caa016dfdb3ac0fab133a0a78071ef56dcb6d2b7635f83920a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508fb9917ecbceacf8ddd3989fabb33ba
SHA197b7fc07f899ff00b69b94bf032c137984120008
SHA256d993f41695970feb02a16fa6f195f26cde9fa1f91e65027cb0835d3b97d14a1b
SHA5127c2f950df76191942c919d5cf26ea46d44b8b5bcc901314e54fccd471afc6ff133f7ad1af280061d7f298cdc442a8623d114171a242a615f67f1e7b8a5c63903
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577433dd367437680b693a078ec394d4e
SHA1b0134b166c347fe41b4dd2d5cebc5f9d555a1e2d
SHA256d039d59c769ef718584443ad45d3f74fe5159081cf44c94ecff4d1ff42a8f285
SHA5126569568c21450e94a7c4d8d4d817a59114d5db8c713648bd11b439be647631d3d0ca43fc7d5cb5d5b53a88fab1cc2663964d641185a4ecf733cb066baf31939a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fb7c12dac2a12687701c265b00ea1c6
SHA114e9177ae3ccfb1303cd51c794765aaaaeaa0410
SHA2568eaa70fa47185261f19b8f296424923fc8b1d85dc26dba590bccad63242c0cec
SHA512f1c5e90214baf10ea89ae47011854666644c17fbebd3fcba1077b2040f6f6b5c67c26ce6bdf2c82c80d2f7050898356afce5f666c00c9c9f962093bb73f536be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554c5bee7bbf8fa122321ffe1fe2750d0
SHA16679bc8c6a197b3ccd9b8f7f6b52e5ba4f4259ae
SHA2564c85c0da1d0c50d871f786779b534102d791133dc1cab91ace9bdba1a99f970f
SHA512eacd0888a9baaa4b83aab43d88a911389164d31f16c61e7badd890a0c86aa41024a3dedb3a158cb938d9ce275cbfa56948430846f918001f8cbc0e0178e8307b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584b99243c0c1b3ea05fee544e0b47245
SHA1a24309d8eec849f1dc1dc1586296219ce7ba29c3
SHA256b16ff166c1996e75c488151258554f127357cf3865972562dd92f4ca9ad69b05
SHA5121f174454fa4cb1894201638402ab89c17a1063562067dd189845fa81d88b50fc950c3c468ce48733ecdd78e799a235bd5ae3a0e1139ce148853a59b7f6164958
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7d4d42f36e39c46a932ef2089b9628f
SHA1a7c31a2b086714c012d55a72fdf554ecc957b142
SHA256c962802e9ead8fc3851dffa7f1def02f3e4bbdd41d834741504c0082ccd16054
SHA5123258f4295db744815c4efd70360a5c8a386064c445141030f7befff4d4191052a788a230b80a76d42399fe9b2b617844f53e10ba7ca9f6b12db97661be9148a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53db1ae878332c8ac05baf36e32a240a8
SHA1605e7a90b8ba77026c81c763ddaf7a18023594fd
SHA25645cd2f97af9a9aa93e6aa3c41d8a8df8e5029aa7b567a172b3a2adf4f0056126
SHA512a63b3ac2e000b7ee537e4ec41614b8a504363e9e70981d2342574a393a5da65a268a690d802b2e08384cd60fbc65187f673cb877a89e0fb06e2ee4030b04b7f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514c04fa51c3341a6bd11e22ac47930ac
SHA1233bd9b7df9709816e6aa96f6a3e4c0a3c7b933e
SHA2562744bdea312019afe5324972b342314840e17338706a920ba48e731d0fbd748a
SHA512187b9570fffe5b8e7ce1590c35aa8075981f0250d5e681f1c29a5296d7c1fdab5e81950c997e000fd4f7902a1b097f9ed978498ceee233a498867bc859d1e6c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565a8ce867f634c6c7183590d9b93bd8e
SHA1ec4fbd380d7a49a5a58949374cd3b2a86389e8d7
SHA256b4678cf61f90dd676554927e8cb0b029d85423e5be116e2c97e9ac0f4fa37292
SHA512d332fac7a4d014b0ff5fda3b54dc49a3b7d6ca7d4ecc6d8c2f91746226f5244479cef0908d12d2bc2b811951c795a18e1bc43d3c1867f049f6c4b81fc4cf2083
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513e3cefafa5393c556c86ffe91886268
SHA1f4d688b73e174fd6059a978cf1beb5f0d194777f
SHA256be913e6f0877979a921fa94be72877ccad4c903cf91d252b9c76507ff8c5a66c
SHA512c8b8008fafbfe0ca05480646f744dd38a353872374e5695ca125b43b56c56899d190da9341929e5dfb303e83ef48676bf3b4d5a44251d646a00775f715b483c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3246d92ebd8c64208ae41410e27effb
SHA1861ae2eee6f6d3c9780b896ab327c2f65c1f3fdd
SHA256721691f4147f267dbba8ddba29889dc4009a4ce05c41f58e187ee191bb98c420
SHA512dae6115298e16783e040f62b075c2cf1ac3aed574c22bd3c50eb33f5aeab19ed89c1056f91b354b12dd6b792aad1f135c96486bf1eee59f53c20d525ab70dcf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a91aa6ca475a6e962fc412937e55b76
SHA1e17deecb6c638e19c31e3d13b45b60b705c7eb17
SHA2563526e128177c1507daea7d34ac5e8c41d30fd4c92c44302fa4f26bd8f89e2aef
SHA512259fad5772b3cfc97b8bd59e1730f1bca8cc33d47c4faabedd3f9f8a312ba9cfe3be66d5267c977c2292d142902bcf375f1fca7b3c3dfcf0e4d73a52f5ffc43b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d700fe273e20d72921ab21eca7cfef0b
SHA123ac11e6f91341db22b49098b10ab1f49bba168f
SHA2565085d04cc185ef1443453ab9db06ff6ff7a300f6a764f8232fd9ada7e0d61403
SHA512f23d5d8d2a7fabdadba1c803fd201c4722575979730a3d3c19ebb0f8003db2539b21821bbe4296dd42a16f2b035446fe97a4f1bf804868d3781807d087d1497a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6c08939ba9aa754cc0a5614d3eb8911
SHA1678807df75189de11dea26b46d2e1aef32b73df4
SHA2560dab349a9b0d8b7ae97615d9d275b7807ec77d0891e40f28265951cf95b55fd7
SHA5123b60078fdbd73146eec7bf1b47a96c4bbbdf80bdda5cf3f6c870e1af38b43e9f76ef6121df32c9509756e1b610d5695533489ff3cdd331ef957cf2a4ec721b6f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a