Analysis
-
max time kernel
136s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 01:33
Static task
static1
Behavioral task
behavioral1
Sample
5c80f1373d4084ae2e069efd7185909f_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5c80f1373d4084ae2e069efd7185909f_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
5c80f1373d4084ae2e069efd7185909f_JaffaCakes118.html
-
Size
4KB
-
MD5
5c80f1373d4084ae2e069efd7185909f
-
SHA1
a4b6a866c484724f60b90b1d82c9a03d567fa67c
-
SHA256
10499803e3d58ae24f8dc7ed5cbf64ff44989bb6fe9cd2d9c289e5cf8c34fa56
-
SHA512
3c6efb7f61f1aad5fcb4cd99f4046215b506e60ff643e0f5137f8f00dc311c1cf3c974262a330414ff167faa9509d49f168171a6c76fdfc989d13ee4b722ba44
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oAEjSd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDX
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000006f77a4af6013304a3fb6709948603f5d2eb69070035efd86fe15860245565347000000000e8000000002000020000000c106fd79840e7434fdc1b9490575b87a37d4cfb3c061d7453b4fdba5930609439000000010a0eecb8422926f299892381e17ea8af6c8fcf41fc7f8271acd5e3caf5d2cf3f1012cfc60ca02a52264e3ea1ed549e56bd1c53882a44a14cf836762d0b1d52237bca02563bce4cf74d1343157ecd2b87cc3937ddaf6ba72b57b3b13cdc61af4259581ec6a40c2dd5b8d4ea3ad0cab6d14dbb3c1024dfe95f48c0e9c064beef695a7a7b405784091775014017245680f40000000910127710d03082ae63ec5ab5b103f48c598d8bf6add4fb9f4f5b9e057c1070a027235fab8476efd218ff02fdfce55ec4123ec766540f4eabdda280b6610e5e7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422330705" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{05FC3871-1649-11EF-A692-6A83D32C515E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f73edb55aada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000083b9d8a7189403aa786fd273e16cb8eb22b4273e30d5aaa4230aedacb3fb9edf000000000e8000000002000020000000c165196d4a677e6286e43147b8cbe61654b3d0acfc421c7e4a917a38b19f33e820000000d9c1df42bb5744b883d5418542bb22c7272984e206c536b37747745b87884b6c40000000adc88cfbde7c9cad36d4c0e280b8e6fec3e3f0535032b9bdf2ad51340c626c76c0ee42c4af91c70dcb02d7db09260bc9959a1da943fd155c2f0f234402790cd1 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2732 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2732 iexplore.exe 2732 iexplore.exe 2560 IEXPLORE.EXE 2560 IEXPLORE.EXE 2560 IEXPLORE.EXE 2560 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2560 2732 iexplore.exe 28 PID 2732 wrote to memory of 2560 2732 iexplore.exe 28 PID 2732 wrote to memory of 2560 2732 iexplore.exe 28 PID 2732 wrote to memory of 2560 2732 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c80f1373d4084ae2e069efd7185909f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2732 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2560
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d164c69591d928092c1f744d2947eea
SHA1a15e98cff5a7e115fce1b36dbf6f126eaa36a0b5
SHA25624e4d15ed631f35b21612fd03e22d7ccea0a8d023900169ff6cada368545f112
SHA5121c65ea4ff06f275ab1b275d1fee1f4f804daacc5e61a4f89fd4e731174a9858cdb1840e73dd122e9f12d320d099a1dc9b869511b35ec042b400fce5b163553fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b32a5f4d557a86ec030b30acabfcd3c0
SHA1e9774fc6928487277c71e48190fd5ec9952039f1
SHA25606214d466b88231797d1fb2cb562f1466d066520d3201940014d8ee7612ef1fd
SHA5124d41fe2fa8b046584e8a7cab4d8248b579bcdcb3aed2335be73dd51dc8838e02657cf1c9cfce3c7e31dc80fae82d29c63257de9668c47217b39120f9b00e0fde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc24a5dcd311b6af154ff367a2a1e7e4
SHA12dbe9252c203e166e36bfdb3d055eae3fae7d72a
SHA256b18dcb3ee7e1f4a9745b13f71692ea8d16eb164e83417489fb46b8850dc65563
SHA512568855b4044cbdf35da64e59dd4f137c46c308e4df9401649e65b1321819c477ae9ed7fafa2364ddb85c849d9e5ccc1f5f7fa1863c75d87fd0145b35288a07d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d48f9083a862b3a55b1f90456bfc470
SHA1ba0eb5d46f12638d571c7585a980b9a899c21da7
SHA25647006e01531b13e40a2ccaf8a0b8c5896ae500c66233f645dc295245d6821f4f
SHA512dad024b46ebed4fdef2edc29bfa0dca9ec07808ec5a889f6ba1aef37e66bc7a2b554ddc753304a4e875ba95373383b7bd458bb7cca56e5bb72f55bcc1e616ed1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58343b24d7a91eb9f3edc3ea54666d3e1
SHA1372fde68d0183323c6aa8717aab5f76b14741b7c
SHA2566f34149eb75f4dc2773e63e8c34a2653840f901c5329b0295695d38692211345
SHA5122ca22dfca6026412c655ef4ccf10e163590b06994109c9137a5d844e5003f965fa27213adfe4c9148295dab6ad881ba0be0124dca66e3ce89e17ac274a37ae4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57842ff4b6cc8cf7a1f7021f1e6267e17
SHA1bb36f528efa647e8dc38d960f382f2636ad15e3b
SHA256fe5181788627b19150c5a287c01d606881321631559b0a81faa1477ecd0a818d
SHA512f72e1c065f8f81d9ab7340097b657925e658f8f25fd1c52218c5304847400d759d53d3da7340283233540b0b463420d7663cccedc75a10242bb78ad48017d08b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cf70baabe3d23892f1fa9dde339949e
SHA16000918e736474a18175e387ea2645b5a901e22e
SHA2561376d915671bfc9954d609fb12a39baae83a383607001d418ec14852bd6dab19
SHA512ac3cd6ec79c0c77263be258ea484a907ad7d91ff3729c8c44f261da4b377f457143b562e58330cce24156bf252f4dcc9696b4f1fcbda9f658242d3c77d01b91a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521b5f5cd215bf83e7a98bdc4891afc57
SHA126ea8b46949af90f9ece845162de6aada7d51267
SHA25647c87665535244d74f084a0b71c9cb34d3ff948b3360dc078140769659ffcb31
SHA512f89626d37f83b75137db2be9c3a610eb4aff5c9958b5b31cb615f6e8ecd2aa81a9e1515993d42a6a3ae1f3a63c504100541670b7872d01f2de6cc48d2c5d323a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c3b4f3cf440af06a3aba2367e4ec5ba
SHA1976b552602811e9fc80e72b6b81fdcadbf2a1c2b
SHA256419161861812d9e684b54861f3ee57b26e873ac1c058304fc1dac0d2706faba8
SHA512d8c9747a18b53b1165e08e7832aa8a3c8c4cab584624b53b90a2027d2dde5844ddb8be18207fa7c1292b1115f413d11725cba7dfa33d4f17f8a023036aff53c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544d6db097685070bb442a2e041f80886
SHA138ecdd948e6fd0fc97949e08ce30ec063b9dd5e0
SHA256a39b99e645f28a0458905b20f72ddd9bb2549b12d7cc3a02f658d4e3efee9074
SHA512f4bb840c5dd08cddd50abb03388054ad7a7bcda2d11411eb6238a6ec0e7a76cdc0d9169416ad9fcc394e9c3ef9f463d6e2b6afb028a5610a51a51d5a7fd44d92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5535668f5cb3aafb0f1aa732189ef5d84
SHA1fe3032371b6f656e68b0dfa9258e06a51ae73292
SHA256cb8df195803b8c4b90dfcad5cc79166c9bc5be8e13c4383e4dd8b9322fdff7c7
SHA512168927052da43efe34b7347601e788aca45836e70e75563fa0c83f1e0261f7432ac0054c2de37a61a9399bafc10b4107982d5810878b940e846f74aaaa89b8d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbcb0e212cb328225b8961bcbec64e85
SHA12711a02d41870791c4e6856242fbf6be0ad1903a
SHA2564400c455ab443d87af81e7cb107fb3ac35719614b83ca0690d0b2fbc9ff00bac
SHA512af3dc7ad911b4652ca0bed6acc2040994ebd1a7a64d1993b952ba523895e299accb4002899031ced9f6328314d4007b7192eb7c0ec4e8ffe3c45b79c9cbf1f61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590062306b2c08fc7ea61a7a4993411f2
SHA13bcdc91aece784f322bd085e57745b4e383e74c1
SHA2561d30e7fc9a5080f34c80c4ccdc02acafe9b1c9c2290414ba221d8e956ecab8c8
SHA512b20df1975217fb9554892fc687f9a60c9f7da3c43a581cedbde9955f28c1923449fb0b252a3ca1133fd492ae4f41a44409a15b1477635bcd8159d664e896ebcd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5374118fe07c692da5aa5c28c458b527f
SHA1af0db25708d99806efa84af8e62f2e6b0f7ca502
SHA2567bb13841d2ae16b77769f3c6011e62563f03c627f9a687a10d30e4994b122cba
SHA512a43ea2759c5e00a3ed61f6281fb09c9fdfcf5614b71f1a48afb724999078678fc1b71b9538d3cc953096a6f8301afe1b3e96d49110fa185484b7648070dcf4d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe0a3e615e2f8bf329b24deb9e3f966e
SHA1bbe25716f52870e137280ab337c124719dcbb6d8
SHA256fdfbb478c0285fa4aed66dae55e3c32e110d537b8261827937aac0114e1b7f51
SHA512ba37169ec3a5b0b54425dd87478a165e519dc35dc1cba91604075f9b49bd4240ab9e1421e2243b6c5a42e12b2c4af0cbd4bf10c680ae9c893b1d051b979808b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8548af6e2e4c3105d5ab7632c48197b
SHA1f5983ece118a4df61208d49e3068d312a5865871
SHA2563f02e4896a57c08e1ef1ce7abea03165af3a80648bcb896a755e9e57f35f7712
SHA512f6dac8bc7fcb4b2389ced5fd91e50921f544f6667602bd045b38dfaac96caa4881749c4e3dcaf7e7ed04f3be34a59dc825752fae408f75e38b0e89b29c74fb5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c595b73c5d67e950751ce2d9648bafea
SHA176891157b8ffdc8962fa551d63bf9c19d3bb8171
SHA256ee5a4057168ec8832be87300a3c40a7291977fa9fca5320a6f772f618cc0aaee
SHA512097a4d97a73decbcf8031d1086af2e903d8db98d40dab9cb814968c4942acd3f7053337a1201d14b7f477b3a7fe6d03b2b2fa00b0c889f4181face5762738fa8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a5b404ec079ce087689f4573aada2c0
SHA1afa8a6dfd225b70424a16a058c821a53985ebdae
SHA256a13f4cf111926a771039008cc33f60c0c224f9714ef93a4773e74c2fc318bee9
SHA5123d8952924be601993c985a52299897d09a87facad1bf86bbe632b62f4f5f1aff7575f0f6602fa31b6f102677efcf1d25640f5445d5d8c24ef906724ba677c8ce
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a