Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 08:46
Static task
static1
Behavioral task
behavioral1
Sample
5e2ea15facf04a025f0780b195fab2e6_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5e2ea15facf04a025f0780b195fab2e6_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
5e2ea15facf04a025f0780b195fab2e6_JaffaCakes118.html
-
Size
34KB
-
MD5
5e2ea15facf04a025f0780b195fab2e6
-
SHA1
16a3c6088c481a46f8d7076da5f6eb2f10cc320e
-
SHA256
d91c7b8478ea3d3574f5434f25946298b649ffce34f2e28c68addbb40bb6874a
-
SHA512
3ac9c6bf8b59f94a75f5fad438e7cbe196120c7312e2f39f80d9acf6b4eaeee96a3bb18a13efbe4705dc6fbdd791f679477e5fcd283e59861930e7ace82599c6
-
SSDEEP
192:uwP8b5nTg5cnQjxn5Q/bnQieyNn2BInQOkEnt1lnQTbn9nQOgFcwqY8cwqYbcwqd:rQ/gnP8l5+jmqsUpJX9Of3
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000005120a6a0ced3940cadcc6146faa77eac86125cd147bbb2b3d1191523b2b13e7b000000000e8000000002000020000000ce418fd012ac6a4b8d965b769ee7ddf7366c7ae6cbe7f5bb2b6ebc560852aed0200000000b4b1fd16d6742aaaa4230635b4adc85b1d590dccae3aa61512f783d472a1abd400000008e3fa687a3de29035ffc231eb01c581a7adca25c589f8234e47ae38a6d5938fd2d5cc8b5f8bbf619f0a9e1b02cd2dd22ccdaac0bf7d7b70b67f16ac56349fd1c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422356646" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000006d0f6a40cac5ef6eba4985ef00cc038b467af9a03496ec853967a4f71c897466000000000e8000000002000020000000396e9d34f0afb19ef532c38cac5add6760947ebde557d990376de3f3ad281008900000008e046676353b51218c0910847e67db220bbce7238a91c63c5ce54ea08a124a4e96070f02348fd3ea860fce0a6e03c03b3ccda6c2a31547287de04c09321db7097be3cec9db1d64c24e2fcc80c8a51c7ffc968737b76713cf8169dc0adcf506eb30378de24eac1f0ca9e0e17dad780db9bcdf213749053f4fffc4934693adc6b1e3e9bce27302e5a677b0b0bbe38be81d40000000ac494d509747b62942c563a0228bd82ce37cc1d7031c8d032b681f483cf6eedf404bf5e34c02f48842636f0e19d6f95f2fe859f3438a4633947afae08ed4d200 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6CC64001-1685-11EF-AB41-FA5112F1BCBF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30ba834192aada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2240 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2240 iexplore.exe 2240 iexplore.exe 1664 IEXPLORE.EXE 1664 IEXPLORE.EXE 1664 IEXPLORE.EXE 1664 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 1664 2240 iexplore.exe 28 PID 2240 wrote to memory of 1664 2240 iexplore.exe 28 PID 2240 wrote to memory of 1664 2240 iexplore.exe 28 PID 2240 wrote to memory of 1664 2240 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5e2ea15facf04a025f0780b195fab2e6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1664
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f06d0aae884719b7a08d37c2cec7106
SHA1e3ea8857ae0a36ca5892b50f90d04fd0876a401f
SHA2562d1c010f829e395fae916b391f75fa48c57faa0bf3747e9215e11ececdfb3053
SHA512af391f8f159791fab3b2fdcce4c5e510f824ede459354dfa05610ae88680bbba5a32d90f88d076b9e54e1400130f2c4722c207be49fe102d9da3e6c133ba160b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58cd14359cb5b12cfb8f30a6867200110
SHA1bca957b939b0adbf0238f633f4a7a6d5dbc9df12
SHA2563cd18acee424d2f1f1c86384abd41ae1ef88e748f48f5b0ce2ad9287d3d8531b
SHA51243453f030d84c11f6bddaecd8924bde6c16023af2dfcc49253f625da806805289b1eb3caf46fbb95714e7988dcd35083a374fc8072d9b180a0c89858d1495eda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524f2c410ba867c52120d3c53422a746d
SHA1bfb19a5f5b4ced5741a71f97ae1b29822dd721bf
SHA256ccfcba36d647f18cc0584f962a310fcd09053817ec0961703d1dd4f1066b2794
SHA512727fb919e61f09ad76cc28289cf3f271a372ce4e1a87217e8b598de46b458ce7e9f4d2f7340359b9389b5e3af115c41487929463c36627fd7a7752fd19547a39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f88a069543b7d249b258861bd0f9933
SHA156383d688708bd6df456afecf1575eecc084d0cb
SHA256fc7b309f815b09fc4ff2d566078ac951a53ac6d4fd3f05d7d29bdd7a23e696b1
SHA51207b2595b624708886e1dbbb0be1dbc79297bd96472e422a0de43a9432c96fa06a2a5caf7b9583da5326a6adf6c0be3b9c2ba32012df435b93b4638cfdd61bb45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e156fe69d69e1c5a2acde0602c56ff9c
SHA18978e6828d0887a2f5027c5ac2c572fb6319fa9b
SHA256463a0588e6f58733a4db87c9405a0c8a645f5517fc73af7a5b07716d75e3dd85
SHA512e2f27b33c50c15c490d2424cf23787c18d33021e753a41aefcf742e6a93687363aab6aea68de3dda787dc52e34cdd4df24635410595824959de5f2bbf518e04d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54994c9545001e6ea296a71bf7325a55e
SHA1f0b98d3f006a9cdf7da99791589b6538872246b7
SHA256e9a2c64c00e0a2bbf8012ed8776c1d97f9297b517ae0b5316f77f7aba58f45f5
SHA512d2734a19dcc1bc05adda039290b4e53731dc7b1288d0f4d68d971374d447f2bacb14de64361dd15190ea662ecc1f5e98b5df37528329f55c6f90545f07a64583
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d018e8e7466c474a6825dd2da18116d
SHA1204dadf818c4c48582525fd353830bd6b34f08df
SHA256d86673048ad58c178f1146254eeeb3ab79e44665ac29e378beb62fbdf8d597d6
SHA512bfc2b09f6b6f2fbff091c463bceecaab9da02e14820c619dc004b8771570b539f20569d161f69d061e71ff53676dfd22698eb923161c94186ab7a649d8c7f116
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576f1fc47ba3b8d2c92922fe64cd1aa72
SHA10e8c80267519a4473b7d688b46038a7b22e78755
SHA256769d553657d132b8f3d83df1da2c131b2a53ab003d31fbd538b4f58d74efb162
SHA51294680d5998d6f4e0f77e817b6e7f745edb15a79c2f81decb7aaa1a0eba528ebe1dad6f11434612a472bc3a5aed04bba97d7415af2b4a4e495aa543e3253431b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5087f1ae36972a6c6c4682fe1a59856c4
SHA1f558c0fb80b550f6db74d97b33e0d7e496323fee
SHA2565d2310fe4dbe72e49684c05a12bc8d0a7072b5a359fdbd09d76d3e7ba50e11af
SHA512d92624b25c5d6a5e910195b9075e1298f57024bc9a644c54aede591670e20cdc8ff63c7f67b29e8eb4a0050097e8940942f56d7a49c461c16946e30addfad7e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5290a3bec7a055cc666ed0d3dfc7bef2b
SHA14509191ebef39b9eaaeed6521c0fbed01602d060
SHA256c010e64bbf4376b48c9ae50fe43b9de7f9380fa096452fb8f1fd14b559c0218d
SHA512950059736dd3d8abbc9555069d9bb0a51ae74d04f20bb2b367e31f34bcb3a9405aae00b06745909a53c8a0c93a1fa6947db88c11893a87c7602f8cba47ae28de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b433d95e6ea564d733b377f9e0b98922
SHA1abfbbefbdd88b08d3135ba6528fdbe4ef87bb35e
SHA2564cbeae7c9b4b92d02747fa43939e95582b72fecf750ec1560fd27a16fcc06458
SHA512d34f358d7a76f61d55b23eeb8c9ffa699549b84830fb8b3b5537c9105c0aa1f610ee9de6bdccd31bebaf0e549b973c426b983a613beeee0336ad2864977d2114
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0ff180f2c13539de0c4daf424f700c2
SHA130e2d145d8db238cb1e30d1212a64a3a15ce67f7
SHA256f860b7df5e51c87326117abd970f433eb9aca950a558b718646f7cbf6def980b
SHA512eac1653cb6a0a21e182bf30dde98cd5e57218ef3999bff486012421a079ae74cfbf64e7448c7d587fa1aaa3708a1d9a73265d0ec6293d2b811ce1191d4e9f7d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eba0659145fc7711bcec83549881edcf
SHA1ff3b8f666c7afeef6845365b35cf69b18805a934
SHA2569f327730b8173c994029277493f98338bb006830ff051bc2b98f5423c1dcff68
SHA5126cfefec67321963f7fa9c11a6b41ded09958dcda812380c4cc0f4fd07b6648ac8dfd886da44684b67236745f3f91d46b5073e9e71a94b916741c6d20bba4ca9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5295bf78802faa139cad8dea366b97e4f
SHA149fe76ab2693ace46c8d6e6d9670a0ffa0b5ac22
SHA25634b7df7f8a3391363a76fade198db335709f1516fc375b1b183a3abe1384e1f1
SHA512beeaa2908f61db724358d32dc729bafb9594b37e2ce6303e85f0e3fb952af281aa187a9bef6bed5c21d245f960ef929fbcc02cabac323fc65d1fe616c53e9851
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58adce90bfd6dc33ffcb51866ec683d1e
SHA16c6d538f559a22571180dcd72423d54db1c07c26
SHA2567bdb67a612c08499b985c9efe38384741b7ff549e537da80d209a8e3a1a2b874
SHA5120756e1cdfecac4c0c8c95700d3afc6677d85e5cf7e8b6a360e40be3193cd16c70f45ee748bb848daffcf7e7547c1e49cd863ff72bd6feb8afa12739b55a97d24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50228071510c1cf6372c7db09ef62d4e3
SHA1132d95fa99a23188719c53195dbe8d43ca76cb6e
SHA256668aedc4e23ebcbfa2ed7a048e407aff7d0bfe97b8447364a890632632594a4b
SHA5123c07f35c2350678ce877cca82468d7147b4c4ffb9e24694c5e7595db272f818e386153792096aa74bb3704c2d00c60b790079868dbf06a298ec5591d8320b7a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e01dacd13ef4bd7e228be52c5a6966c1
SHA1e6449ff824a60dd9f3aba3b0d299fbf2c70cbb26
SHA2560df0f9f7331a0258930fcdfe8fbfcb9198a25fc4dcdf25808d3eef462c1fa205
SHA5127975947b579c6d88d2a0dc388d8671bfcf3e3a65dac9c1c5445afd68866b8d9c420503778b78a5e621d9ba10c1b215793730962bb0b1c6163604a3cf122e505f
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a