Analysis
-
max time kernel
117s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 11:41
Static task
static1
Behavioral task
behavioral1
Sample
5ee1065b18db3943ed699a8b461364b3_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5ee1065b18db3943ed699a8b461364b3_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
5ee1065b18db3943ed699a8b461364b3_JaffaCakes118.html
-
Size
4KB
-
MD5
5ee1065b18db3943ed699a8b461364b3
-
SHA1
900093eefd60fb8744a71c1597eca24511ae1ece
-
SHA256
ce10480c3f5d74593b32363fd6e99f0d9826dd7011bc6e64cc7b522c17089c1e
-
SHA512
f6f83c69423e430970d0103ff6742250651b35f9ba1567ddd7396563a6fa1eac333e51750f755d0e3171a6e104f864f126f074d897440bdfb6a394f7d2259b9e
-
SSDEEP
96:ziEpQ1ZmV4MSEPBDvV0n47ej/hgOKiljSR1QnyneqhL63AAqi5:zi8WwV4GD8/h/KiZwQn/qE3/qi5
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422367175" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0faebb3aaaada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F1261C91-169D-11EF-91CF-DEECE6B0C1A4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000033c132af14b6abedf9fd3b4914768000977d9984a77d056e2a86c4cb71a2bc4000000000e8000000002000020000000a2876742a1ab0c5dbcb718ef9bc4ca4a2ea97573af7c74370a34d2b1bf7e12be90000000f25524facff17c5cf65a93cc402f355853a181b85ee3600114b711775f7d0006be8ac1a6f82fbe4ee3f19b78323b1b16ff93157ed6f3fe86f5a39208fb67f9dfe2ef227cee7cea6a754bde64835055d8dd8f8138108f9abb449343b96e0c4c9e6530eb6c4cfb32b5fd5c16d2a36af3e418208d81d8c5be67c23cdf83cf344ed51dbae67a690ee235debe0a764a0a66d0400000007ffe25669ec2b50d7472c50821087b472c4d0546cc346b336a05fd2f3495ffd1a7f4dbfe97d1d98e5468f3751bbd7bafcb77daad64b044fb57083217e6621ea4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000003642d3056cb447fd07f96f2f70d3141aa0b3449a8b890cb80f4a1913bacb94df000000000e8000000002000020000000e8e4621aa06de467c2f071892edbd6749aacbe775148d983b8503148f1b8d86f200000000245b5022d58d4cd9649d8df71401656a14140149270224e32a21964a4fee0c04000000096552b944ca5edefe531ba713c3cd2ab554b4a8f7a9b19b7640f43592d6bb8ffa89c73b76cee7d7a41010444a4434ed6075cb16f00b96fcb4aca7feb26eb669e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1424 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1424 iexplore.exe 1424 iexplore.exe 2020 IEXPLORE.EXE 2020 IEXPLORE.EXE 2020 IEXPLORE.EXE 2020 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1424 wrote to memory of 2020 1424 iexplore.exe 28 PID 1424 wrote to memory of 2020 1424 iexplore.exe 28 PID 1424 wrote to memory of 2020 1424 iexplore.exe 28 PID 1424 wrote to memory of 2020 1424 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5ee1065b18db3943ed699a8b461364b3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1424 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2020
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e736de5e6505850751bf70336d0742dc
SHA14fe75600ce7e64b35f75f8e7496cbaa616236a33
SHA256d73ff345ef529f846fd849e90378ad148ddaf258850b0f6c214c8ae083a92f32
SHA512d16baa2967e4b1e51af44e90ac57b0a19c5d47b0ceb3d47dc11e2bff9c3e9c1b9fabee07ccb3e02705e0e7318b53b2a7e2d18b6900e18633ef8cdaa234d26606
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f556ff9ca81eedd5dd585512b7e4637
SHA162955e82c3e19ec6cc21e7c0a5bb7152de4b1414
SHA256ce44cd09c27d08f2277d9ecb26481f72ec627430452c643d7adcda2338e1bbfb
SHA512596c34e3e576cbb421d02e3c056cd789841d8302c8b0f72a4f5a0925a9e61feaae1ddad42b9912f15b811b9c9133b4345ce4c7d370394c8e8848dcf980fe453d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577482cca17483da22658b55238be5ee8
SHA173e3e2a39dae02dd41e8f8eca5c6a9f032ffc3f1
SHA25610bfceb6b06891627f34f113d5ab2bfb92e8ceb82e95388ed895b5067a52e825
SHA512ac047c5a296adacfea1d32b57d3e308cdc2f388455c91f1870d973fa7e24111a43c7f8730246e6d93a5e906de63397c49dd539eede292bf74c58eb7a13904312
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2157863159b501464199e69640f8360
SHA1a70a3faabac524a5b8fe4b32b2d60d16d534d58a
SHA2560f0d7ca27207940ca0f0742ff06bea12eb61c104b6a831dc6b814cff0fa0d101
SHA5124f11a5c0a6695f7ee9e7dc93e0143dc52bbf9ac179d4b9aa76bfefd13790aef092cd0f0623513ae7fb560c59848b113f0f3a730db478562bd2cad4e9b0740630
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c349fe815f270ae54ed28b7e1374507
SHA11032a07c9c9b1a3e397b0d0754f9f3c87b542dcd
SHA256be6008e1eb09473ea321e2e1fec24374923d6274fd72c0d45a1f344b0a03e135
SHA512ec2d831cf0216a8dfc25ca9fd612d6f0aa21f4535bd494adbc1c9fb706fc24cd4e766456e0bb776acb1526f5489aaeb77205f3041d97a71c7a4771017927011a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b63ab886c40d7b707f34694008e1ffd
SHA1b005603c8be98b93f93f4c4a6b59f9485d82edf8
SHA256c19bf93fe609a115e4a5ec48b0a07c3bc0cdbcecd6e44b938beb1121fd7555e3
SHA51214bdae9668d7cb5b28895a0348d7e9d48a0075d7b993078c36bbfb108b77214007cc1c072c7ec9f8e7134cac7c01091e337dd9f069dda0857fd7ae980c402026
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5575bf0cf53f668e08b036fc649c8ed13
SHA12ed53495dc012a165d0ba8fa4040e61376149c5a
SHA256b607eba96dbb3398bea1ed5790ebaca17fdd3c6055748c8290e7f3982241db45
SHA5128c160f1e92991c6f037576539cd25ecda5ab8ecf732b42b6cc388fdef570a67a15ae7c641b7d50cd94ff7c824b2d5de6303886acb936cb85c53104b3cb2d4201
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58408db59ca89d172eeb39d130a9e96dc
SHA14779857512261a1f00991b43ec689ad72e0557e5
SHA256d1f5955b21cd07c2b3c0036944bc60178501bba9b74fed4e90b5df7a98bb30ec
SHA512aae99ffb405165552e9f93a25fc27803e3e3231f8d57234d23e8e78639929ad70a73883468827e9bbe1ad822b59637645229f300dd7a513b6f9e66da377d9da0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8d49bce7d5e903c0ae3c953e0eebc62
SHA1e85b2fb8b16c91996920cb5be792b618fb9decb6
SHA256e9ac3d0830a6a762c34f650a1da3b43ebbb74c7a6ac90921325d498c20879825
SHA5126e01f29bfbfa530bda3c73c88909c81b75f211c0cb937f7853ac787f201ee6540f2a6c904c2eaad413befb45f9ac7eac01e5cab10557c0e3511cf1d42eb0e4ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501bd7d0218cded86948e34403bf5d34a
SHA12dffd9b2da0d14aa34407d73e5e1708944e6f0b4
SHA25662d44548c2ec505e313e2509729e4400e9850434c89990cdff4a3672b0138542
SHA512d5b99ed910104a587978de6d1c7b64c066cc3f077dffaa940f1fe2aca5bdc6af9b616f43b5ed2d53f1a3314889ac94a61027e137e08e6b8471195533382bc5fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd6165eabcae9e78ba914ce0f61f7aba
SHA1654a78df9cd6cabc409a33a510ac2694684c6f50
SHA256d87f561f608f69837b06f56e0674637062c483785b181230a7ce3a2c762e9ad4
SHA512daf49e21cb3b9446e578e3322932f100be1f9d6b7b0c3678de7ef781f368d76ab3b0064ce791b0993bfdfabc306349f3c7fdc0f443fc4273f691a2833fa258f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff681314aace35ea025cc7c8a767b83b
SHA105779c6a6eaf2b68f60cfe5fa3e02bc956d144ea
SHA256cd34a69666ea9dd758f89a8b60a051da771234679ffd68b0806b8f19ebcdf490
SHA512e68f34e97d6d7877dccfe3615a064fbcd4c863b549bdbba1ab3e284820223f3c2b9f18f02be75a6f87ed4218ff6bb556db86bfa649defeb4aed754f451389243
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a85ddc8d62bb7b0b035d03a474ea7596
SHA17f95320b12e03920ef942ca2924fc88b1374503c
SHA256891cbafee89f7800b76dbe641f22e9198e515f39e5b33daae803d4d488a86a00
SHA512feb7fdf491a613a1860a2533abd472b422e7dc01c1ab1ffb131fc7bddf90ff8bf4a8c275f973daad8dabb07433832fb859bab051079bc6ed73224ae54ed193d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5012ffaa5f7678233fe2a1302a8600536
SHA15b264bd973f2d0644cf8a1b3e56bc81ba6c31db0
SHA256b5db03d7e9a6bdc8800312540e10b1419f9526fc218379faade8a704d484e570
SHA51206ccb704e5c4dd1cec5adc6b469a6f122105b862547d683eaa9585a7bb27e1fabfd45a93f41e90b46df1bc705c2247ee1ebd65e8d3b27be39099f5b9ef43cc8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c09d778dac779b2edf1a741e214dd306
SHA1690a82318e0a0e87e1887bf3043b0110e2792345
SHA256f464e2463d3bed1507c21836532c90c3094a3666e1e4bfc17fcb8e58170ee52b
SHA512124bec994ebdf60c1e8dc6866e094854a6b65bd56ef6eeef2bdbe83e7aa7bf1964b4695c7c232f9ea50f882fe9e9769dfa1d8645b909b4e8b6f8168084470207
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c4beb54ea4c3ee19dcf65c86fbe4205
SHA18137b33ac2c3f0c506a2b9106857dff7d682f15c
SHA2563a0a428049293c0ad409af12d02c1120cce250d145d3a81a000e45d466ce9676
SHA51220b26399b32311f795891677de611b93165837b03db67b1112822f3df76117c359942679814676b8f69739b6b1eee4e9de2720195a86619a3ff43bbc3e96dc12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597d7a21eb39f9b1ac12ce77da3196d04
SHA16dccd28df76f5e01c465f64889b21108759d3944
SHA2564a42917ce201e028d609eb99dfc5a6a6c3749d2657b1454c6acedd7de784f1da
SHA51222fc25cdd4f582197daf759df7d6f96506a7af2c0b7900292a3c2c85aff52d94b56d54c7567e20ef1387aa095be5fda4880c144139aac1ca187635b94e583fea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f72271b13bc889e736b0a9edc717596
SHA19d4a9515a1a43a4a1f17166c3ff739800f394e5b
SHA2561beacdaa32068716c3e9bf7c318c7d82fbdcb629d643704094bbfe30c5e8c3f6
SHA512ec32eca640e32b4d60e83d992f5f6aaf89bf12e974f8032514c2e68c5a38ac1f60ae00255c36d4499daace4b6bbcd5d1e2ae2b1445a4b3d7c89003a66ad54347
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a