Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 02:27
Static task
static1
Behavioral task
behavioral1
Sample
5cb8a603353700678f2ed4f1a1263be8_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5cb8a603353700678f2ed4f1a1263be8_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
5cb8a603353700678f2ed4f1a1263be8_JaffaCakes118.html
-
Size
41KB
-
MD5
5cb8a603353700678f2ed4f1a1263be8
-
SHA1
57d0db95b93074f6e9432c8817a8b2c4ced75b4c
-
SHA256
dcd87bf140167a31fc8607b0e032dd85b91f2151c8682ffffe5a117db36f961f
-
SHA512
f68659f1857bafe86481b39dbe3312fd51ae8ccbffdfdc7961eebafbc36717378aa46a70844b76c8986e08e0d0a681fd680f2a09b0c851abbf8b6644e045f0e3
-
SSDEEP
768:SLQ29SFtPn4yqeqWkmu0NBlR2EThL5BBpL0PXzlaOYufszMoYSLaEknE3LTbBmlX:SLQ29SFppqeZkmu0NBlR2EThL5BBpLEv
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{84D58821-1650-11EF-BC3A-56D57A935C49} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422333923" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1712 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1712 iexplore.exe 1712 iexplore.exe 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2972 1712 iexplore.exe 28 PID 1712 wrote to memory of 2972 1712 iexplore.exe 28 PID 1712 wrote to memory of 2972 1712 iexplore.exe 28 PID 1712 wrote to memory of 2972 1712 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5cb8a603353700678f2ed4f1a1263be8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5f94b0664efa057c51bd8a4c93fd531d5
SHA13cfb56ce18ec5843ef6c48fddcc2bbe0b1c25b45
SHA256804667a6a86e9e521a456977240998eef1c35bc1cc9c6f9474f549f38315a5f8
SHA512a889031d81e8fc855ddb3ca67d0cf216dcfd9b64c0db1346e80d54296cff3b94eba5ebacc315f50875f68647c1030fcdda14de5a12df31d338f8e216bd7a1d06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590f2d4e6ca07a215b42964099052139c
SHA1928877b2413bb69ccc0f5af795436db4060e2c2e
SHA2569bffa02867325c396629d949506d1e92943497dab3c3cd0f730bf082e8f6bb65
SHA5124dc0a29dd8428a9a285d1171401a077a0b1a242ba7c890b8175c9b00bad9cd98feff68d7216a23ae92120dfd9be586f03cbc7760841afc762fbdb201feeb5cc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf83ba408228647d2ee15a0ae8583ce0
SHA18f4ced69443dbe01bea988e3d310446fd9133738
SHA256d3f3e2ffbe38c9894f5407c8f81546364e4faeb51ddbbc2f73a5961185103d7f
SHA512832f844e7cb7c808338a24db55ddb42fe596885aa3366f4a01ce2408772d57c2a42a29882a8784ad8ea4cd18cb8fd741d126e752835dccc43959fb80f04faaad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2b10e1ad97708b29db9f06dd4ae19e6
SHA1e9dd0fd1e6e77566c5447383093e0cca2c1b6fc0
SHA2564d81d84c719002f82cfe50495c93c678f294f3e49c8aeb073f228e5cb71f33a6
SHA5123aba0e848064c3081614049c222b612628db8485de248471607e234b97bff2b9826c0635c2a2d743bd9400e746fc021b279fe9f8b57c0810ba8f51e286995836
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565e4245a92bc330592bccde4f671bbe9
SHA16600a99ae1013a0c29809b71b60b17593b7c84a4
SHA256911b6d3bd6d62177a6c7b1ddd6d050ba7fbd94a8b91d408e119ed1623a122995
SHA512f443fbb32ca4fe730918fe80f81cc65f4eb237100cdbdf25ae8ea0e2d216a12d6f8335fa058b2befa3e9b55269f353cc3793443ef8001c953059bcb027cd36a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558381d7a90d4c743acae52ad964c533b
SHA1bc28cba72bff0f31b6aa030223db0023bfae1432
SHA256f7c88d371ab80a19240bb80648ffb6ea64f4d5ade225ff8d9a56d592b6d6c2af
SHA51297d171e08e0f7ea5922fb1a83a918050efdb9c0f3f6d3459a9cc3cbcab5419912a2fe62df71217bc25f39041fd13d31d723a03e3f8c1ba3ff919f2ebc5b90ea9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52419a73b07a8599ef76b0f02c53ed20e
SHA129c01ce1ab3648eda648e1c634fd331f00724cdf
SHA256fe10f7269e4ecf01092dcc4c85748cad29063686575c8e5678316c3cd53ce2a0
SHA512bbc9dcda18eeb70bb37ab9503ffdaedf5db8573e067c7181a9c8a35117c391861d8d5355b810746e75b3304cc7dd73bad5df20cae7aae892245a51968890118a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557de1dfd69d05a5a13bcedc635f85403
SHA155ce47f6db04eb5b323abf1e5474fe4e5eb91979
SHA256a35e9a17a7b8490172935b34ae306e6768942298ac4029f8a95dd0d4c3d34256
SHA5129a4cf3808a150bf099cd4a1d72df00f6d2e8ca71dc4c6e3f8d7fbed00912eab6b9a3e5cf85477e11f3429236f231da2f3190322f9a7cbd6f17a636ec1b44c8ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fd536ed7eef5cd7ade6b76c7c3d2b09
SHA1eb462e1cc6fe6c9e98d4f03ffadc7afdb880f56d
SHA2564f1281ba0abffa5c77ff423412fb63e2c336e8265f4baa2026d0cb1823c50302
SHA512567f7660760d13577620f6f00198ca11bfd388ddb9f251757174349017497dba093b0101fa7430273f33d351ca0ae36e520944c455089793929ff07caa8db28a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a136852c08692f1b8af12dd7a9d7501
SHA1891325b6037cce1a7d39fc5672cfd036c6453b79
SHA25657dc7cda0caae8d3c3301ab7722f475382e3e60d2693f44a21690db758e12de8
SHA512225fca17fb55bd8070a84edb188f5354ad9ed8946e3f817af061a184ef5d7e9531c371f513b1ed92bc18f9ac371881f4027851fd136bcd4c6b8b264b81ebc608
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514faa9ee9be73ce9fb30000fb1b5e451
SHA1a04603381bfd2043f9580f0d18e7faf562464ed7
SHA2564d9966e6b689a472d00d0496e66891c95c7674f866edeec969bc2f10b3b4a47f
SHA5120ba624b020b3812b0cfa1bfd9e918af7d15549fb5d06ec6ed678494aac27d7b47bc337091425a60960004b6612eae0d198ce5abad33dc1009144140930bacca0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56665dbf525aa683a8b16099db1876bfb
SHA18d9aa87dd440123e93b13efa6853fc0e2dfd3379
SHA2562d3eb902a64268bce0a2804eca74d7596fa6d663fbedd1427d73692b1c7ca68e
SHA5121fa12797b6b69a4801ec5e0416e9b53c37f98cba25433f109af3d86ec4615296a09aba09a2f4310cbdee1809c7af3c5af1c93c035cf2c2d3d2528b2350943bd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed806ce1c692000253a00346f75c21dc
SHA17001f8d133317b1f6f4d4e49432e0045d9ada231
SHA2567a98d001af2a74da391ad130160cc75042a8e2ca847a8cc385d82906f20b923d
SHA5124ae9f8d2341e51ec3c1c2fa563c732cb17b8bc6a419d42c6cce350cc3f0b8022c5411bbcc65ecf4e73b3c5caa82c95b0f07cafe0397c03029669fb5940d5656e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540d86a4b487e9beccadbb9607c47ed02
SHA1fd006510b087dabac751cc3c2bd094329c86dd05
SHA25606a4dbc53e525f201d040f04803d603a873d07d83190c7178ee03cf10a1066f4
SHA512bc95233edf0b084fff84e9dafaa067990ed0eaf3ed07044a6e5cfb9adf8e1019a9ce2f56b7b94955d224f1223775dae3f808974b4e850d89786169822a0c290b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4a156e02f0c81b3198a529fd01a816c
SHA131211c1ad93dc243d426a02f309ef23b37baedc1
SHA256f172a7734052786812613f1611978d5fcd21c060eee14a097e6868ba90a5c6b1
SHA512b0f3a8aef8b7c1461ea0022aae7c89e420858d951bb8baea049941132346dfc43aa6b89920f445c9875a0766f3574bfbf4d926eeb99270963bde78dc1a54ce00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5476d9781f114dbe2382864f49da0980b
SHA1fc0c993a89cbf2049ee064cf46043192a7836a6b
SHA2563d3313359e4465f7f780b2d89b72b1f145219330c7785ffb2f2fb46cfcd7aa93
SHA5129ccc9fa3081d85649491fe027c0d700b82cbb9932739cd8997b22e8ce4f9675340de90c85854a72997116f92b8b240e80a692e85c70873a3a5fdae85f10bede4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4fd533f01a4cdab201d3deb77503433
SHA1a4eea04b2ad276386a963e4489b2a0c82966a396
SHA256bfcfdb4bfbe07bb1c90151170e95e717b9d35e3522c884d7bf4362be437bb9b0
SHA512edbe39016403e18b4a5fb493f53dd8a3944957ec5aee312aefc2ba12cee74f45284f2742f756a976c7e745cae7a37906210504ff798d1bebf04898bf93009a5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589d48d6ccc1d5549f5e4df8484f9de70
SHA15ba29a40175fdd2525a4d8cf5a0e4934bc5d0c2f
SHA25602f29b6d801df824f0adfde0cbfcf4b96bc81a4d32df59b9baa8f5b5ed41c672
SHA5120bd50790b39318fff883b2f7711c0a0ed231b143a5ea87b95d9179da28c9e36ac758aedf2214da08a313816e6da722838d554d7dadf56d0154a4c64e7dc62506
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f973f3497f5b7f2c2f06a36f5ad27f74
SHA18a98919893925c357c4f2870fa8bb038b1c6e70a
SHA25662ac180f0aa6a8d230ea297a3250520c490c330bff00bb0c76053751b2f20b8b
SHA512d1ad9dbdabcea95eb39449bc9ccdf2c00bbac8cd05d3a05661b1c470c16a1c9e054b910c114f87b5b2676a35fa522b616003479b2c092512d6f495926db610bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5881f4b366ac4020056e360014d2f07a0
SHA16388722f3031cccbf0bd0a6f53efc6d15c0d9dc5
SHA256a663f6f18be325af1fc0b7f386b287031b80a61f10b9ab112dc805a7cc5389d2
SHA51266a62b3ed07408367f16eadc7cf5b1d001a1c819098ef6642563663965ce3ac8ca62ea676d00c85b3c1d8f81a71f84512f691ee2edc5908c0c946ca503a3e5f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b559a2c87fe33041bbb2ee7123f472d0
SHA18a489a9efe416ad5b76b85c1f8cfe6a508b65101
SHA256ee0560056ed7d4dc5d44d9e4613a057ae31d5a48f6b24c75b7848f5d54dcbf42
SHA512f83928bba5c5a7c698b16300215f34992db7b2eab6a2b86282d2eaa9df625c7011674f097d57521a0fdf880ab07ab7f465e97d30ac39407ecaafefb6f55745dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559f664b89d6552ad646a7b83ce680cce
SHA1cf062a1692a2bccc942082ae9cf4fc5095ba1bad
SHA25618972716e65c2e4cc2dffd7f2e7252d2ae96f4e672f87fcec1f8677113afbb28
SHA512cda983f39ebff51074565b1c42383df3e9b7a6e5bf6c365f2a969da7506307233e828cb82544aa08fe7d79e85b171646bdcf7d15a93fb8fa0a418fab2babdb67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5f81beee3d496b8b346521fd7e546b99c
SHA1a7138605ef007cd7af66ac4fab2ebb087abbf702
SHA256a48459dcb921d961c6ebb42586034fc41b959e9131f311b49c353fe8c6fa844b
SHA512b4abf808bd1fc14896d98999dbf961f6e18fb5f97ace5d7290dc94e777700a01ec8dc4c9fd2b3cd7d72ecd022f66f54e994bd73f42e38d2fc3cd8bfabb6b6b0a
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a