Analysis
-
max time kernel
140s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 02:31
Static task
static1
Behavioral task
behavioral1
Sample
5cbc6adbba2cfe8209f6bd62f8bc1637_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5cbc6adbba2cfe8209f6bd62f8bc1637_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5cbc6adbba2cfe8209f6bd62f8bc1637_JaffaCakes118.html
-
Size
6KB
-
MD5
5cbc6adbba2cfe8209f6bd62f8bc1637
-
SHA1
abca74f9323ddbf52fd77b18ce37fe073eacf83b
-
SHA256
1e349b5992fc390bc7f8c732c25d890be221b2f175ae49b4b0fd4321b84cce1b
-
SHA512
db22b8dafabacac75aa602ba250fa5371699e2fe392197e0922df8eb6fbe222e39d7e99470288a5482ae5392905bd54231b17350c3c16029c872286cfc7ffb93
-
SSDEEP
192:IhUPTNPa2EfcwjbhlhJALVWlF2jICT/W3K:EUPY2E7vrKU+xO3K
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000005c27e8e1c5c8b184afa6940b2069d999ce06ca92e99c6a7ca85e31ddc87de5e6000000000e800000000200002000000075eee4e7c9ee2c45bf8b53777106ce33dd3d8b27084b69341d86874f74b57f8b90000000964d925db078a19af023941496aaa9659bd5b0e50fb99ca7fd4bdafae6e91ea6ff5de52e28612d4804f89871d836bb14d022e6d2db179bb29457d00ab18f603b994894ee51d764d1a6e142c7e0feea688270ba52b2d67a215ee5115d489c703d67f677d3b117781f5db7240602ed4c51b52e2169328f747994e0ce175a6f0388beaa047293636b10ba178418470dc39b400000009d2035e7a1e8f8a4d65b0165c6a5b6210a12131f45b07255c119151d9975b6f84bad2fbf4076b2dccdd415f5b772b750cc69b209a84866d9491c5ea959667203 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f742d45daada01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422334135" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000086723d9dda96f4f77bb9ad69a07f94840293f04c01ccd661cb36abc62b4a1725000000000e800000000200002000000083e5fa06aefbaf176ebdfac34b30f4e2eb0b43cef4a064d872e52dc512fc3c8a20000000bb7d7edb3e6d57b773e10d98fc035ee2a88cb793c4b2d3c3e4a008b165b738a140000000dcdd42d2e17a0cddaa8fadf6dc6d7152d595cb87ad208bd9e30ebed52409c676222d541de4014aa42c82de2f29fdd855e5d1e949aaddbebd5c1f567fcabb0b64 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FFA050D1-1650-11EF-8E9F-FAB46556C0ED} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2604 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2604 iexplore.exe 2604 iexplore.exe 1284 IEXPLORE.EXE 1284 IEXPLORE.EXE 1284 IEXPLORE.EXE 1284 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2604 wrote to memory of 1284 2604 iexplore.exe 28 PID 2604 wrote to memory of 1284 2604 iexplore.exe 28 PID 2604 wrote to memory of 1284 2604 iexplore.exe 28 PID 2604 wrote to memory of 1284 2604 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5cbc6adbba2cfe8209f6bd62f8bc1637_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2604 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1284
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543a86e814d99eac4504ba9a947a344d4
SHA10b9aa110755226f3b517f044623df19c6529fa02
SHA256c7cb72c918224d90279e4c765ded32fe83bf61950633bb8de162f0f83f286eff
SHA51202b28e479603226d97600dc1cc2a65d678a3d9def6f2a06ad9ad60e2c5ba926a675644bf63e3b174417541e8c91f3d60791d5588a5755de08bdf5bbeb03fce19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1df6ab9ef4d7854e96dffef848622a4
SHA16842688f588ab3d0c50d8a5704b9029ce6aad31f
SHA2564b15149c40b7609d96b4ec82b85eabeb341deb32a80daa8c6f8934dd244ebfe5
SHA512c4efe8d0fc3e2bf7848401176df152a9dbf5a42b02d38bd9719f0390692ce7b2222f13c0d9a74254964edd59bb389659fa88d0dde5dfa72fffd250e236a380fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504c588b38bba2be8df732fd5dfc9d18a
SHA1baadff8398866115322cb89298f137d20fd3154f
SHA25652b042b0c77f35ff7b64bae283a55f903ed946c79a7ae39d72f65069e9acd99d
SHA512bddd50b3e36570383efccaea7b8a4cf2b323fc040886fe0a634c7b092e2e313ea637891be7d0725485648794ffa85c73f1dd27daddb697e37a05ebbc0bf5cb06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a62f8de77627814a7ed245bea3b8c1d
SHA1823a69282ed7aff8895a5641a06ab1ea01c4d7b4
SHA2567010fe74a6d82536b9bb8eb11ea055f2b0aebe6a64ead061a0abe03698a6038a
SHA5127f47397e2d8a7bb73e678001719bdea623291ffa0de13301669a83763fd51798cf1869c079cefcf75daad6972cba3f558338bd8a84d7a6ee39deba2eaf08d742
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d34ec5c3aa605b968a3f77a3e2e5f0de
SHA171d2a655a9d0ba64d2e9f8b72313980df77e0369
SHA25609066e2b21841a7418d4fa9e56a27f1c15c59ddfc4ba47064136553840f63677
SHA5127048025909a2cbdb18e1f81abced43f6f3a52bbc212185f1d671d31707296fdec37181de66dfa4674f8f4b79d9944c0ff2256a4106984299f3f113ebc1c90493
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b458d54464c705bcc5a826cd14b5254e
SHA1667f85145e1ccbc134400e7ea90c009b1655a7f6
SHA256cf91d3afd43d7a7ca9103d55bc70d2dd8fac0a71a28752d6794c26442326f552
SHA512d0f213100fe99e52cefccc26e6bfc9f6b451ea5f4ba13f392e2a860db31c205a7f5f1fb0282d78912aeba7e78dc04883cae8fd8b21340502bd268962090f913f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54074d386f6ae5151b78c3eca7cef8369
SHA187d8e6ee849180a8696cdb60f0cf76dfa4226a13
SHA25638d9e1cfd4b91d0873ca6c54e146d203e034735f3e2dab81ba71b52785bab307
SHA512a0a3b8f16d8a238a8bc60fceda09189185e678ecb6d8bdafd8c1d98dffdf107ace0f56db379918281edac7ff1e4b17784f83c54b7e1dbac0e718b6d948b6df97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bb4563d2cf3e72cf8ae4b08413863d0
SHA189ef46b985ab647a663d4e78227070baac720bec
SHA25617fc9217d36c59acdf27c40324a26895a1b6cc4422130cf58c466767853dd3cd
SHA512a6116ff176fcf68f8ecdeb98c6de0f76d1b592b388d1b98249d5efa07b760f54a88403636068b1b1b0890563b68f7eb28753bca2b2b6ea0ea9628f1e5761038b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9d0956b2ac20ac680da562de5c9d9e1
SHA12fc55ffa21ea90bc53e972fb15a477f862685102
SHA2568d9232af609f07e7b361d54fb6ea9e3896c548d745a2d9f1076d2f982a3151fc
SHA5127a1a992ca98ffe25eb4c8c0d11485eb80a8357d0384568ce76ba541ad25ead9b8f22e75615bca3c0440024856a6d151c05982d4d2b280b159e4f9d96824b3dd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e65aff1c85caef3ebb4f0b9d8bd19187
SHA133bf23a17f7a755bd8362f3ceafd7094d8cfca7f
SHA2568ae454a95ebd2c5f25780da34f5051c78137fc95419b0d43474e0696494243b8
SHA512a7e4d798bcbe9191ef0c6c8b9e8a81598f99cfbacb80f87346bf5d57bab6584e635debaef7867f5920e1c6f4248d8cc5aba50eb4204eca6a45f324e33ad075c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535ceafec2c63e6ef2ba7bbde370e96f0
SHA1e20de39825e17eb6a73604e092362aa6a3f47d6b
SHA25611f58077854657aad08623026c642afeb4d3d35b2aba6f18894331a137dfda2a
SHA51267a446aea7437ccd51bfabf42e55188a7f44e448d54f139ae691bd5b89f17e0871dea020be0051b063d986ab2d3a3749924aa17383902982cd33b94e53b92eb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a2f4a681c99cf93c96dedd6b2e38919
SHA1b1e1192e3ba3395fd40df30617ab0d92b2f32738
SHA25693947776e5feaf753d02e241a3814efa3dd66dd30326e04b8802bee888892381
SHA512f9d28aa57c5706f900208b7530e5b3a8bb82399a99d3d85ae7fd002cb3befd3485425d2d7c54c980ec7b9fcd7727c37edff89b3319bcd29330f12e8baf3f0ff9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a022c2f0ae8cf1c38ecaceb12928fcd
SHA10cb9bd12ae2bd1fb5c295af0155f5a334f478094
SHA256ace9815883a71c334bb89b4822419f6e8e70e62b28c4f6a3cb2fd60d8eee9cc0
SHA512b3ff1afcb00970a6c4b39846e8d6e808c11fc8f7fd79b2f37eb459adcd14a904c829337c8ee84309dd5951fc9167f19aaf8c8b083ba4fef7918c42c0b1cfd2da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52cbb784f48970c85479fe1683305f2cb
SHA1d45f3bddaec2a8540750eb28252b90eac449d3f9
SHA256ae7082cd57bae948ca1fedfb11409055246d6137eaec022b69e04f37958840a0
SHA512dbfdfd39f4a3a325f96b81165eb916fb07500af21875febeef147eeb54672640528c9eefdd465e917cc431e11de8574b1bc9353ad0db012d91663411bcff5337
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5574472e9dac04fb0d76f8b33cca7b773
SHA13ebbb83d4ddc0ab9503494591730f695f1d1466b
SHA256dd9a4266339396e6bb101961422ab7f408598458cc34ca90bc6ad4da75d62ebf
SHA51294af10b31b2673e7c384429c9c5d9de072a2ea44799250ac4ccf418d6fd12132753fe00f6a5c0b9561bbb9321f139ba24b9a32aa059ad03a943319d2b4ce24d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556cb15db710fea94b00d07f807ee781e
SHA10efa559efe12df373af7004e81c2f74379747719
SHA256ba16871bf3a5ee1a4f5147a7e1393fb03ee28b39a567877ff2052179eca88037
SHA5125468266cec914bd1492d50953c912f57b852d7473bcd6a1de1112223ca46e9cdf154ec670174fa3c42c469ab7c6c9a83d8b928de39a9071d313b3d01d78bb76e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2acdbaf796d77e47727f29431953b30
SHA1d43402569b19b6b6bde3b55f947f78171af718fd
SHA25628b43f3dc0aaf6707d1e3692a95adf44a3375aa5ca511a43a2390678781e16ec
SHA512e36d13ae5f9734cde7ff0793f499dda2ed756cb9ef775f1d0403c5ada590c9f783b686a8b47871c8a9fc897d46407607068c9ace016e4be572cdd033d8d9387f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54dd5a5e2167fe114d3ec6a81cd8f215b
SHA1661829f3771d7516bdfd3faca672446bc26ec3ab
SHA25600683be29a8211a00f6c0c1e8725a836c34b0746f1d957e5ffbd74b42be1ae25
SHA5123f107122266dfd276c64673babc14db8d7d4e532da78c7d9338dde311128a3081df73c13b4656239da1f46ebd28a66f36e6d6118edd87d7bb390fd85ea792758
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522f6c276069311d7502a006188cbd8fc
SHA1c654587f79f9e974b16e5a24b248ae1e32e26ca5
SHA256c37deee96853540351cf062ebec19a811ab8d31aed6ab03d8ec0069e59dbee39
SHA512b47b10cff805098f53267132f1e112b103f0215ae6fd752338afef9beda12e6860d32f84ecb7d5104c42af4a6f0df750c6e20c5ada68ce47aa0c5201a6b1a57d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a