Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 09:25
Static task
static1
Behavioral task
behavioral1
Sample
5e580c8318595fbab1aadfd3e4c9c923_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5e580c8318595fbab1aadfd3e4c9c923_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
5e580c8318595fbab1aadfd3e4c9c923_JaffaCakes118.html
-
Size
30KB
-
MD5
5e580c8318595fbab1aadfd3e4c9c923
-
SHA1
64713ac059d7da8bc664e193c002b31f55a659d3
-
SHA256
7be2bd934979fab4090a32db18785beb039b9af2d4a9331a931c890c72ad260b
-
SHA512
1906b72eaa9982cef309f66aa17b9af06544f90eae55f484c2614324ccd419e839acd27af6380619e1da6a478e1bb968bc5cfee79ece5095c0c1bcd8251790d7
-
SSDEEP
768:Gow302PSV17Ia75H6Cq+mTACDqbpIdXHyhe7:GP0wSp6Cq+mDDqbpIdXHyhe7
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000088d6184cef2069cca0d00342f22ce4e0fdb51c2b63736dca80a37c8dfd083762000000000e800000000200002000000024244720dfae55642d3d342f72fa28778b71de7e82f722e3bc99bd343bee1c03200000008b79cdf9e4c76c1ed73b53fd26a1781dc2e00f3fc7cff3ded8bde704e2de77c14000000061e70316ce5a256a68a62d4fb867819a4a528fe2987d5fb784c72c4ca108661a221616c8fcac8e8a881d9c682da875fc004d7a01ec0507d43eb5bbe4b4e71774 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000d8c91f03b2f4a030c87d4187bfc0f4d968320cacd376ca3979397f5639b74f0c000000000e80000000020000200000007d30732e538652448cd973dba102887cdb7dbc25f9455884b3993049452be695900000008045458f74e5ad64e1cdcba3c4164789178376f9259264c5439c7c61042e36dc8818589eb267a8d33cb90786be88d6025749cd82f788c97558b8d91dc7a87a47ab5823c7fbf0ea9027a4f9f21d447df0c418a5d3caba12e98159fa556545dae821fcf6417ba34076998fb527ed68e7d90a58b504884a5cbabd3c057467b725e2b6d5001b85d307ca513df4dd8158bba140000000e5d23a1bc450d95824ca92e5388377b81ec10824692ebbc9e515f8831701b19fe47dc226e9d1057a06f9e614edb65456ba258ed41366af48a77949b19607e80a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422359010" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f09773c297aada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EDDA8611-168A-11EF-AB01-4E87F544447C} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2056 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2056 iexplore.exe 2056 iexplore.exe 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2056 wrote to memory of 2648 2056 iexplore.exe 28 PID 2056 wrote to memory of 2648 2056 iexplore.exe 28 PID 2056 wrote to memory of 2648 2056 iexplore.exe 28 PID 2056 wrote to memory of 2648 2056 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5e580c8318595fbab1aadfd3e4c9c923_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d41a7f329dda896b08deb5276f1244a6
SHA123d3b2e0c96a0abfb95fcaf99a84bd062db4e946
SHA2567a83aa068533ae393793bdb63a6c8e2d5fa57a5477b2d4dd5276dc332a17c71e
SHA512139c7102a5f1a565ee2c6f424a7b7e19825b50ee1f551f22d80c8fe4a06957d3618ed25435b0c40ab74dc6541a61ff0472086eccb7a76954b0ff3e058da7a7e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb273eeeac52c3b70fddd589cebb7105
SHA1bdf7ad48ff8c70b7bc55bab757fa04a00ffa9627
SHA25699bef61e1c8b85cff1d2ff6c10e0d821720d56f44a5a1f3150f0d3a73f8c806a
SHA5120cc41e5178b0062640a8ca8de8f4a50c019bfdf38d00fca4375057722bf297c1b9ed5d77b2b13a12015724b1b94de7c40867701ec270f657f769281aa847233a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5038cb1df74060e7bf571e015011eb9ec
SHA1b404c43058ad96d88ec8a67e03fca99b188c1530
SHA25655efcebbaccb40eab787ffed170988f60962525cd7bb5769b266d09a2bdb33fe
SHA512bd75e89a66fca7c08d3fff4271f679778eddcf2efe2ce01c5f906a1c0d214aab5d750290d18b978fe0b813697103957e9d43bac2c65319ced45ad0d781dbbdea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e47c6769464b982cf540c7b0a25f3bcb
SHA135ce88b5a27887c0ed8789240be245509092d159
SHA256d13c72f79f6c07965b3316695b94f04db2354167ddd3f6d387ef164107571914
SHA51256d71ce99037ec759105b65aa96a39fcfce24a3243ddb71320499d6e552a67e01c2b1f0d2bfb67cd062a1c75a4c0efa9d06a58962fa95b3b97f08a0dae59e18a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0295e90b91d9d3196f444a2076e9618
SHA12422f2f14193b5b9c9f7b763f11c26670b4da887
SHA256878a949d7fba933bd34989483cc63795c9416ffc7ee9a8fb785c4da03aa61561
SHA512c2d0604b36b9c672f2a6ff37fe24e43c1d601431d0b30d8f1e3b5ba231c3f94461458fcf2088384451907aff06015211a5ecf546789a513f49223d401d1be0e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52158ef2b57b72ca4d8c839518f1a48b2
SHA19c52a1d7d15bf238aa7703a127ae4ac8fa64aee9
SHA256f37440f0aee5a88eee91226be916bd55909090a8c18029f596bf3403ca6047f8
SHA51299e10c5364a13cc4c5fc814eaac5256b8b8a01b7f44421040f23d42cdcdf7709ca61258dc7e33f65805a23698fe01cee3bb4d206f23c3e35102c1b1f297d417d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a35f95465e67a868dbcc86af2c4f686b
SHA12cd9d376d80cc5261df337ff7a0d182a6fff161c
SHA2560d9800538f8e46a75736219e0f362b6abe42dca1cd943c53e783f67a086ae449
SHA51229ff35e66d41ca59c15f5699962963c4bfc9f61d2370b0436826caa573fb78db759074f2a58fd27665ee2b9a20616d7d59b1ae3673f1ade49a23c7b2792aa5da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a3de5740b1f94c73501108e075348ad
SHA12eb23b3ae2b92d1d7a52b65dcfcf8fef7349f1f8
SHA256fd6d72bc346353a73c03bed7a94dedd24620dbb863bfdd624d5560974bb55eb4
SHA512e6489ab7c0de4dbf6caab7827033c9b7c1d119b9de481890066ec0c3459d58bdb377b4f4ed84e2233124262a7c45c6f064d29b100deb9b8c6e186f1b2339cd11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6de165ca8fa37c34b7b7037d5047fba
SHA19767de4dc804dd386c5b65f8df7163c68c8c5e00
SHA2569a6547e916fcabe823969ade110549c6f67e5f924cea2ac167dd412bc67a9960
SHA512067b24db9fd958547afb52a088407ba715b901ff21137f9c53c2a9deb5fd42510b6a7a905b85bcac78d64e8e546f072a8fdb2c94f2f0b960577965ea40ba876e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9ebe3187f1b55b4d17393a9e4466e90
SHA16c57d2998700ad3822d7e6b7c36b99d0dd384843
SHA256055e300d5be61547bfbfebffbdcb6486f79d50594afde014791ee3d71944ce3f
SHA512f29509442698ee571f5e1c75e775432583dad63502becad559fe6aba135ae3abf87e04948248c3eaabadb8ef219f7d013c40db01a8d878097529fae23d9a4e2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e39ad5c0374a05c23bad8f4f08e85e8
SHA1f43b8bb1df10fc10d74376c15a9a49bc5ddbc611
SHA25651e76377852123ad79697bd96306a5891250ab03002fc3b59fd4123078b9f2d5
SHA512583c0ba773aaaed9ec16c20b74492f2cd2e5973f38e1f14e0cf1ad35b04699f30fd1e78c013eb8c25a58d2a2379cf3c58c7bf105f81aadd6e00058dca7c4d02c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5597143552f2101b65084cfeb7fdd680d
SHA16f9397eb5864916fcb2343759d48dc97552f1085
SHA2568e0e1c7a79fa546643551733f7ea49c49106d1e4c5da3eb5d769af037e46c65a
SHA512044e787a59fac8325ade69773305c70208489678a546867a842a5497982f6aa52c5575b1afc4cbaff4a742b995516de6a9896d517294fc82647c8f920f87ecf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bcdf55f411d15cfa8834e328a956d3e
SHA1495bdf66f7675772c5ffcb3711e3b063dc12ad42
SHA2566dba4968ba18e1ca835873cb4d620be18dd86b8735f9c8ee7d7b76d7ed2e89b1
SHA512da254be36b41acbdda905ea0777dd507cbd43290234b4e7a813e3c743e64b936e6d0421258949fb412649d3e545656b585252147be3ad8f7d030c40292884422
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd008f17c651d29ca2aa0b6944c620b7
SHA19f731cc2cf57f128d8dbd274c131f9d2ba44e567
SHA256f9a5685662124c22453a0d69214d7ec6ed44d504f29065237d2229cbb5c0a8cb
SHA512bbf7eeed7379e5b73b69128e0dcf88ec7ae205e3734685325e1e1e0af7428cb310d0672cebfa0c1b797681a997044c52bf8764ed4eb7bd470e9e4b2304b993c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cfb94337e316f3f43b40be68242f3cb3
SHA1bf8ef1b48db729a5a0de858cf6558d192811ddc6
SHA256eb5cec2998ae90c899ac57a7b26c5a64bc81a2c8951b5ab8b6950347a783f011
SHA512412d38de38c4ea03e31688c7cfa0529a676fa12fc80b0124871c5312bfe6dd65a4089a3e07ef4fb385067de39dc19dabca48ec5ad5402d60353a0f8a109b3ebf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ead7cf41e745139035782bdf30862389
SHA16f93ed78a42bad2947b728c74f5a893c2bc83ba3
SHA25636fc61e576f7be057384fbd562461508dbbf6c640667acfc2f3c80bcae7c4e15
SHA5128a24c1fd2f9728d2627cce13bcd477c51198910352f17daa03d668d87f0e203cdc29ed401c4e1d0b1169b95f466d3b3db463fbb783832dd1ffb28963f4f39794
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536db04b912a2c0e1412e1eba78c6be2e
SHA18218e5bde7441a2b7a2d005e3b5e594739be1cc3
SHA2562798efe80f55271d5a6cce3078c9b8daf39d2743aab71e1f79a7358182e990e5
SHA5126a304ad19f0367fa6a5426c50ceaea25f305bfb1f2e0c332dea81a91adcdf2b95bdc2d7c265dea2fff28171afd73487a41cd3c0d1246a9158d2c5687e265c897
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509b440b6b53b644e359797ae65c87fd3
SHA1581a5ac3032867a246a6a2a68b6797b9a219b024
SHA2568c2fefff9690e283bbad560bdcdc921139bec55244d3252c6d127bb447d6507d
SHA5123888bbbfcd37ac6ee93e88fb5f91658d5e2be3604bec97a507b6f0bf8cf2815bcf89a72045aea52a689a9e8a1c4f58be6c002af119fb1d4ec0003eed486ff091
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a