Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 04:08
Static task
static1
Behavioral task
behavioral1
Sample
5d1ab0ca82b59d6309a9e7a72f08000b_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
5d1ab0ca82b59d6309a9e7a72f08000b_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5d1ab0ca82b59d6309a9e7a72f08000b_JaffaCakes118.html
-
Size
55KB
-
MD5
5d1ab0ca82b59d6309a9e7a72f08000b
-
SHA1
1ad649329849183132e0c591c3dde08173dcc6ec
-
SHA256
fbd78aebcab357dd28d1b8e88ee44483bdea10845ebc896e1794e23a212cd55f
-
SHA512
4d49d433bb4d7e4a946ca2464ed11bd346277ee704d87de87d2ad2aefd78b8a113cae6f1e6b27a233955702da158dd225bea804e4e776e73d7688713e449cf6b
-
SSDEEP
1536:bZEJk7Wdpw9/unsZuopPX144X9c92FUG2gJ3Xvc2h4O/vAPMk:bZEJk7Wdpw9/unsZu4SIoAVAH
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9044069c6baada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9113DE31-165E-11EF-A4DC-6EC9990C2B7A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a52ceba2032e9240b0685f78fdc42e640000000002000000000010660000000100002000000036fc57d94754ea2e6c402bcdb98900a7dec7043f6273303c0e28d0d0833b12f6000000000e8000000002000020000000657203b192786c7653c8b6bd14d08d058164806b168a76258016793e0106f38d200000008411dc8eab231b9bbfba83b13d9106f945595b5bfca4695513a342977557c5324000000080b422d9dbc419387cf1877910e945eaa63ee3386af0f45e286803970fd78bc1ac803dbc9d10a35700c88dba17878b8e697ed55bd234945acdf8310b723a72b7 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a52ceba2032e9240b0685f78fdc42e6400000000020000000000106600000001000020000000ce3670d8683343a729d8a00f628e67da9e170a7e2c16ccd98bff6fd9e1bec452000000000e8000000002000020000000085f2cfac14d9bf54bed3fce62a45aaa8232b461fcaddd6a089d45bb3903780590000000592d883dc3a6c98275d05b093534ae9160d10450cabc678bebba83f18e5d3290cb916ec3a8ef6e1281a455b32eb3ddce66153f38bad4e65af6367d255d4c882f54632a5513bb9c6770bb6a4274d3c065edb0ec5f2030ac2a5232d765c13fdd406094c9d4aaa2a0063e5edb69f89dea0f89a24fcae6541611b41f7dda302346b9941fa30a6548ed8cd12e264f0e2200af40000000340364d8580a8e7ee00d59b140ea4cfa00e7a5ff91d706ada89b260c06c6104945b46a9262c63f6da2cb67b464a1b5da17a8fcf5777a621c2243746bc2814d51 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422339956" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1888 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1888 iexplore.exe 1888 iexplore.exe 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1888 wrote to memory of 3036 1888 iexplore.exe 28 PID 1888 wrote to memory of 3036 1888 iexplore.exe 28 PID 1888 wrote to memory of 3036 1888 iexplore.exe 28 PID 1888 wrote to memory of 3036 1888 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5d1ab0ca82b59d6309a9e7a72f08000b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3805ab9434b477065ec3be5240a0c22
SHA1b55fbe1449b9afcb75119fda9d00ff6948dbb639
SHA256789dde0239f00e93c8da8e0ed9e6739158516d71a5ffc838d1757e87360df0c3
SHA51256f3a45232f39052360dcea1945cc9c36416c0fd2ec15cb22ba8c0a6550917e8142ba4d450fbf46ae089979e5fe603b0c7884972bb86a76fbec87f8b0a34d7aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521521872616e99da4ceeba1fc1afc67b
SHA12634123f1c3b1469a5e55b9304cbea7098c62a44
SHA2560472b0721a799ae9623198b6b7b533b9df423be028c146c7cf225ac9465c1338
SHA5129ba86d5dd803d2f4f8c8bd858623f12d100db75b527099e2e3421384e625391d8bebbab74cd2da2f5eb34f801bc6a724ec0d69e06fd9ee015591abc00fa6fcba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6ce2fae63f6c0d4249477af56a3cc79
SHA184c411932eab019888ab7fe3106d1202015a98c1
SHA2569de7785ceb78265205f2a85c29bdf7961ec0fd91de398adf101580f5a8a6cd10
SHA512532c0a611a67f8602da96e716b0994af99ac99ab187ae75bf70d50e4e42d116f26cb8ef9f87d44ce22f2d9935852892a8e01228c268c8e4a2f44513ba7d3c7da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a950d9ed4eec7cf43c3919876958a08c
SHA149325649f154b6e3023e71240a35c3c670eef7e9
SHA2565e04dfb356c510c054059e82aade84658dad6d98c47ebb000864f4021450171d
SHA51286e7b73ab34f8f3fca753eb8b29527bf5a14226a179c05af6b30ee9fa18ede5852a8130dc33b8f182acbba7880b327c7272e456363ddbd54502659be3e7dcb05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb50fa55f02ec0bf1de5d82c43e49c67
SHA16e63dee723564bcbd235c55b1f5287c1d4831580
SHA256e8717fe891b94f1c53a0ea331ca2c9fdb149891338d1843f3eb7b39bfca56a01
SHA512e29917becf93642b89a805d94d962ba03feec89a144e9dfdfc38b45529d8db8f1cf9b53753860f4fb49dc6f14949ee35ef8458985d85c974f63806cc7fd0cb9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e675768cac64e8f9ee3e468cd51c6f1
SHA1c3c56cd51f159d960577ea3d631ce7b40707b27c
SHA256510b7d2f9c09cdaf3e084bf5431c7f9ee2ab34bc1000421fd03b69ac8e2fafd7
SHA5127c57cbec2de1beda96e65eebba3d27a2b14e150cf71dd984ae631227251a6365b1f66604e1ee689606016dd367c9d684bdfb7f60a2c029511613bc9d78044178
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca086d732fcca7de065139788541ef2d
SHA119dfe200d573f9ad9b915429e08dbdaacbee98d1
SHA25681bd20fd474338a3873538a91cd0bbbe82056d30d22f547f27460c3e2aee2075
SHA51246024f9663d09fd250373968c2ac4bf1c3ec6b7e7364570aa9ca92aec44443a997f7612958f5f088432db85ba12c71fc878921fb2f736e06f81a936eb8afa566
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f54a9b2be259ae544993ac9a2b264fd
SHA1943377bbd6cd494357a8446f530a1f7fb1a08293
SHA256605d3db2064f852f53eafb28ae3db3aab2702c061bce048b78bb6b92213a249f
SHA51254b2a2a92002934bb2d2d8dbfeb53339ecd7540c30cbc51f9a87d09f7192c445ffbdac37a8228208bbd28a2fa5e5ccb69831b2eeeb062d83f0d1a552e881c06d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544bef900f521d23c2f111d7809de56e2
SHA11c6a433b5c2e6fb21c4d60b797667a69630e246a
SHA2567c142f81e7a15d75f8d1e3c14f1e5d8efb0c15574903bc6e340c98a3ade5d6c0
SHA512b77cb1f7786e8d7ece7ae07f6985fa2fcc24a0b50cffcdd247470a50407ba7deeebc5e9a500f4797d4cd9f4733c88aa20363e1f573abfc48c4de0db1a6a08155
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a8237d2dfec43457d3b251aaec84bbe
SHA18776a65f33abaadb5a65e2a0a981e4e907c69d6e
SHA25627a026c1875efda4e0976b9fc0ab8974c90a5f415328051b02587dd557b91148
SHA512691cb8efca2fa6341225f52ef09822ab9055872bb01773e296f7461482b0976f0a621a614d0f1c3adaeaab5ed8c7289280ee330952ea78991f0d822091dec957
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb26248c1ab329b4299d0ed9bde63044
SHA11490050e5a17a604e60f0277f26087397410272c
SHA256ecf2f71cca1f37906fd1ead1167faa5cafe2ed64eba526f49b5d7e3fb0cb9ab5
SHA512a9cf79fe4c1f4578f9417fb4d734a5b8448b99a16d73679f1b17dbab585bb4b35d3cf5745d1a5eb0ecd29d366c90f00ff76fe9c5285fa88bd088235ce23be63d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5772ebd7fea5869c07fde10323707f9ce
SHA11264759e78734d60eabc92645f8507e8f31c27aa
SHA25681eaa02b766963e563ea6aa07f18b8e3fce9f541ce6f6b9c410510182409d14b
SHA512598fb170f01d7d4f3fed17b1cbdc226e9e64b98707a92e3c30a6ad2b7c257b271a39949b4e09ef7b6c34ddf8f75caf5f0f95e48223cc8ff4b2be713c5f6d9068
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549d48fb4ab23749e1e90e57fdee9305f
SHA106bf04372b453f49338c47b1f6f5bae8524d8d9f
SHA25611b0c505245cfbb4bed9728824fc8ff1696a8e81687fff7140203fbe635dbc6f
SHA512e9ad4e8b5f2a37973c35f889cc225ebac7107cecdd05c08d1bdec23256ea7d92cc82e52803a02601f3b654e42aa12184f5b874a3d861d9b447ac5416c6f1d896
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56954502daf33201427ec62f87916da4c
SHA1ada4851cfded92b14c480e5bf210f8a4b618539d
SHA2566b1c97521b3536cc8701dc68b54774775e2d3daf9e4fac86c2a01ad1c381973b
SHA512ec17c7039187455db33638a083017abe78c35582e6d4016fa023323aafbbc6275c81303f16b372529c620ca2a3a46e0e52a1d6c6d407e054336d3f2e4074fba3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f1f0a67dce5b49cf8f6e35278bf18ee
SHA19f66b43082d9329e25914f062fdbc46201d64f6e
SHA2564a52a719d1e943c932a1e616441af0c8e4cfb96e1dcdfb4a91e11308a0be5c97
SHA512b3d19df92fab90fd2f5bb7a7c9237353e533776a87baf5da3bef67b367af4168d6e011a204a2c854b905db9e65b0213020426c917217b2750dd9465be8394cd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7f6cb88272d677ca19192da97984d56
SHA1a58c99d4ef4e10fbc8393356cd22640d163fc706
SHA25640d47195917fcf53b87d669f17130f2728b373221342a7204494dcb33656faa3
SHA512a98dc934a80fca31b0294021dd94fbb951fa3e428a5c169205fd2d9141e2cb6f8ef4c39570dbbe29aa1e016e14697655971a3de8c5c42f36d5eea03d6bf0bc78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5451cdd2118eadced423093d6ea0ad743
SHA15adb65cace0fb0ca835a940ded60d23d08047a28
SHA256dfdc97b7a4ba8449e81901a4033229964e21d91f845448f4039a89fee6e48014
SHA512b161b9741bbfa76611c2ef08feb9d0cc3655076231beacb563716e859b502555805c4c5c1cff1ef10c13a2a8b07f3373cfb9bca6b1415375a2a15ccb40effe79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5985a8e5619e8876cbd381ac94ab1deaa
SHA14e35ae0e9d3a8ce0e25493b00cfc4c573189f137
SHA256759a96d1df0c210244e9d12fc45f9667f05d26ab260943b15d04bbc1a52e7d46
SHA51294246fde70dcf583376f80e0ed124a7ad685cfabcff407cb5b02cab13b5975b9c3fb15e8cb3522909edf6a05f0c88a65e03d94cfc6d92d8d3545841dc4303a21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b3bee2def6806ea0bb6cd11c6090738
SHA1e7f58aef3584b07b9a1aeb267f2fa7a9c3f09a48
SHA25696777479e72c7f3f9e606e4ca18ec3ba344e276e3ec01722338099b5ae1c5188
SHA5125f666f452ee4864f4339fa40d781204cd1e44097708d264feb9340dd097fe4bda67bf08a031dbf66d837bd1e079ff6027e08e8ea728e1b1d1e78f14d8eb0d566
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a