Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 06:31
Static task
static1
Behavioral task
behavioral1
Sample
5da63c333be3a32d219661df1550bef6_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5da63c333be3a32d219661df1550bef6_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
5da63c333be3a32d219661df1550bef6_JaffaCakes118.html
-
Size
460KB
-
MD5
5da63c333be3a32d219661df1550bef6
-
SHA1
129a06867da90d2bcf8a7660f16cadf2270da958
-
SHA256
a42c6f8742cb4d24d6788591bef12723e9d49859ea7cdfe543836c5f9bb22e61
-
SHA512
a9d461662cbc3bbb02a0d8468d6e76278e84f54ea5182c7f7d844786578787cc4dbb56087fa62bbbb7839be1f874996679437324ea5d1349ada6c3e32bed6eec
-
SSDEEP
6144:S/sMYod+X3oI+YiRsMYod+X3oI+YlsMYod+X3oI+YLsMYod+X3oI+YQ:K5d+X3Y5d+X3D5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000005af3e3ac112df3e56d10da8ae18e489e99ec6203dc3b5adaf4d983e9edfe4ebe000000000e8000000002000020000000b8bbbc45fee78a32e90e50c89190293881f00f091a7efbb40ba61302cad15cc420000000608ef527e8dd933476088c5fc82bf5b1679aaf47c4cb9d95218e91060e3831bd4000000068a0a0a30e76bcc1c1acccd8521795cf6dd81d0c4a0a3d82eb5357566dd056efe7d212e6f4af0f6aa249e71127003ddc24c90c226b96dab3f06729ce691b0abc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 300880737faada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000567a1492255bea6ceed5fbecd26ee20a7c842b85aa589da36053ea754a3dac49000000000e8000000002000020000000569f4c234a741f04e7907aa7dcd50d6bcb34f324ae7f89758b51a0c6364b758590000000be9a84afb131f16edec76784613dffd349c40a685610656361ea0abe62b0d73e519243f79c32a0cb58089ef368736bc99d23329224e9a3542846fe973d80fb5f518a538f9fcee492b3cb2c8d887a8110b324c2143297be43679b81403ba4a5e4189bb312ef32c5a6c41e2b6ca3653e68a35d132a1a4a0870b93a73ce6edee643a5fcc979ebec2e287bc17d8d649f3a7340000000bed538dc4a45114cb9a4ac743d574672856725e08d03734cf9146d4dfc1e90cf1e7c81be960de453b29bd687f062b4477bf26091159fa7135cdb53bce8765056 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9AFB73E1-1672-11EF-815A-6A55B5C6A64E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422348563" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2244 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2244 iexplore.exe 2244 iexplore.exe 1384 IEXPLORE.EXE 1384 IEXPLORE.EXE 1384 IEXPLORE.EXE 1384 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2244 wrote to memory of 1384 2244 iexplore.exe 28 PID 2244 wrote to memory of 1384 2244 iexplore.exe 28 PID 2244 wrote to memory of 1384 2244 iexplore.exe 28 PID 2244 wrote to memory of 1384 2244 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5da63c333be3a32d219661df1550bef6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1384
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbeab8347b64dcf119a76e701aec6e36
SHA15ab338bab50281b441eae0c0e9e4cf90907d6bab
SHA256f6369ac09bd85fc3d9095d7172c9afaa65a56d15a3b844b9533b9d97567878f2
SHA512e96092908cd2aee9b64e59a1613f3757a4395357db40d19b7b602eaae24d379b90891b691c3c02d3e423c92c35be8db604e8c3de00bd611f7e7df5fc82cdb5fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516fca33ccb8ddce76e68b30f51ea83a5
SHA18cf644810e88c1bb48ccf5f2de847c6c7c8748f0
SHA2563a812e7df5ee7a990414e2a00e8ea72b21419f1183208733f6c75c95dc9141cb
SHA5126606723b091d103374e256daf95f3128b610bcf0b5461e97d970d29efedaf92b673cddd2d4bf8e4a6e230c9457b031b6d22889582b92c5eb55f3c8049e2cd43e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566e2aad553c5b97254f856593e0add62
SHA152adc6d484d8b8df6bceff13a34922e130aa6cd4
SHA2566bbd3f0ded95da0a7c4823ff1b955c5f22ff90f3e365a85b56cb0c7dc62665b4
SHA512ca3d26fac9eb439ca51eccbbd9c264c667dbcda76ed5d077c5d5a74a0bd80177e340ccd96c83dbe63b81f0d08e12621de24dc594631aa4fb0ba216bfa4b18567
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f0493d3d73ebec4a0ea779583a3e3d3
SHA1ac8a1b3dc4c9b5678f8aad200dfd1c4d54b739dc
SHA2567683e3e74abeab6b5a02ac400641df821171225980f2a019b3e00014dee6f329
SHA512dc9248ec2742ae6c4870262e2f81b608f741b1b7e3bd38c583593433a6e2047e43ed668fdd7fbac99c11a5b563de35cdf5fae35e2348aadb03a73f612f19acb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f086d3bc50ebab5f3f5cc514bef24a2
SHA1ae0ff4c4dab6238714b0af1b27029c91c802482f
SHA25663e29a7d8584bd3e292d4176c9b3ae2bbdacffe1af25a6f92e771d4bc9dd2064
SHA5123f2ec28b7af6e0da8ff86e77f81dd41e098166d852d8df32b854963db82bbb756191534c7e7c13601bac636453cbda1a7376f4a1b9fb6e08c2ea6db76666207a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5398da8fdfb34df1d830a317f12777c34
SHA1699b9b20c787c7f8272fcb3d2c7c4fd403b11b7d
SHA2560f4570e3ccaf4b653f4dfe88f1aee84c2205b3c59075ddba621297d5965403ac
SHA51218495778cea5293f6d08e5342690fc909e39f2f8e76f0c13d8f4121ff9458998646fc87472997ed89cd1d5cd8a654b4eef3d4edb74b665d9fed37811e19f97ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d4adff5f68e038dc0bf8b3c09550f69
SHA104e17ffe156eae1906ceaf81241d2c421b22b664
SHA2566e97e7d5fd53761e45dca695c59b7c016ee16c0d1fbfe72100e1d854e75c1e56
SHA51261964d48808da64a6ac37c4d596974f88839fb35b66a33e58925cca900cdc58b5637f52023988293b34e1472857d6ffacbff66de3f44258eecc540f44ff08733
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562d18788a2c6b1acb8e861e3b47a1a5d
SHA17aa1cd5a3f4ef09ac572a8aa3c835a26bf712a0a
SHA256293b208b2bbf8fc5d4d470d97aa6afeff03be9e3bd6d5bacf7b7d052baceb80d
SHA5126f83a8dd8aebc0784f89daed79c54b10837f89b6f5b0a4bbb2b0ae00002c764ce8c319793f450e58cdf70d27f49aac99a5bfe4053a4e88e861a25d320baeb9cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59bae298ce8e8448fc99891a93e8400f1
SHA17b3a10f9d3cd56e4a14a7496f002b6e55397a1e9
SHA2566725d9a0efa957cd6a1ed12ee4da5ab15ed54436a5b0b6c45e032005c95eca78
SHA51274b43205062ad17b2cfc009d75775936cccdcd5b2aa636d592c8ec2f009f0477b65063a9230ad700a2e7bb73e7947f0344ff0ee6e11960d54b5a3bc45994f368
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54964ca40a4003c0e728f56c6ee95cec7
SHA1546cfcdeb2214de47648e2eb0dbcb839146359ec
SHA2561ba0c4720a064cd411c6d60f02a7a274bf07f3680dc7507588b4d856a962ab06
SHA512fc34363e6726e90c7de2813ffcd815c945f4bf8077e033daeb358d258fc560b35b68fb4bb5fe275da90942807256d2873cd647671cdbdc5dc40ddcce628be502
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536deec007151a9728839da0bc6360ad8
SHA133ddf45b99ce63ca7f4d3088be7998b049153479
SHA2563a92f1448ddf791fb8296ef8fc4385468681704316cd6111f2f06791c78de09d
SHA51252435cb975cd96cc78002fb094f86634a391e838300bc658922d7b01bdfff38b43d9544047beb87d0bc5b7642bb267afffd21a149c416ef314739c5a51dcefc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d70b275f6d4e0eea1faeba931ef0a1aa
SHA1888d9f765a10ad2472c61f89e4f81f1b0b06b577
SHA25664d0121d820079f2590f8f8b8d2af11f765f43e56a5e11a85c101ab42e9f3386
SHA5127e7c97ebc0631075f64e85b0f1af7a7ecc17042db5fc29d577f485cfbeed95e663bcc3d80f2bcf16e7218373753134ffa230601bc9445d262bdb0981cd1a4695
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508e7ffebf710c805cd3686e8c6a5b14b
SHA1c94f6b470f8500ed87e22d7c69b669cebe644e49
SHA256d038720b0112015214d9203d5d045d4f5b5a3b5852fb9a1a8fb96637ac384ba5
SHA51296179fe99458a20ab2de795b6830fc36614a6bb15414e94d97050e9a0d66cf7483b9019b175e15043765f54da122bbd6a0f8ba8a35caf53d323e6827e5d487b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd61f87c90fd16a506f7faec29449201
SHA1c86381872da33816046a89de18c02bc3b8e994ea
SHA256d2edff28c99571ee983844d321c0cfe932437c6ec9ed12b799f65225709274ab
SHA512665a837fd4d56e2542fc1bc01bb1a6aed3fe119608e7d532f7ce0813c147f6aa83efa54d15e399e51ed9504c73ed8a02b5b2ed763555d0541c926f77af560c63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52033cb23311c99060eb39857afb21ab6
SHA1fe5b2ba0372447cbaa93de36ee3185a3c81ecac7
SHA256e6ec30f975d252e237673688fd5e46a959770ae04b93917c9205dfd87b0fa5d6
SHA512e5133e5af83cb06c03ca4cab6d1800a4413abfe110a68696fc83b76b869322dade0a8d1ef06f51a3d7430f636e0683721537c19f28258ea664d9f8aa1529731b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d56ebd9fdfd935fbd01384957c1ebe2
SHA17d779031fb38a8946d92db20267511b5ae2de97f
SHA256c9c76f4355b8f031064d52b21fd6eb8b9fa382e8630f7007a19a23b0cb2285a0
SHA5127a281dd8ce5abafb86afe743451a5d55bfe862b7a86c9a1733f3808fa3b2f45d223b93cd0dd6bc0cf4cebfafee046ef3615c56949dcf061d26a694b14ae06084
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f56c97c39a2b47681da532db771d372
SHA1bccc764336e7eaf8bbe7668124621ecb773f3fc4
SHA2562790aea68522eb1a6deef602c8248d3a05db9823770f07945d1c1cad35054665
SHA5123dfecd1e3812a9c368d964ac4e9bb105fefcd9b9876b074fa579d6aca298282eb4f4c457714e3951430b7e74d20246957d97d8184916bdac3e67066d1c7708cf
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a