Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 12:43
Static task
static1
Behavioral task
behavioral1
Sample
5f2299d90aeb7c7922ef189a11b7da08_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5f2299d90aeb7c7922ef189a11b7da08_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5f2299d90aeb7c7922ef189a11b7da08_JaffaCakes118.html
-
Size
122KB
-
MD5
5f2299d90aeb7c7922ef189a11b7da08
-
SHA1
4130b3c11413f1951f639fb94337f270a6892d34
-
SHA256
d081a8fbbc62aeff1398e50154b611c492d05d295e1655c8cd5517f4b0c84a50
-
SHA512
3b6ff70b904248521fb1356d93e5fe91a7c1fc981bdd70da6bee6f55211b2f04931b87d6a1a98988315d6573f76a33a7068798decf8714669be5c8bf7d764d19
-
SSDEEP
1536:1OfOByLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGL:RyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000023b03744555d3a8101ac8d68959b61a575d540501582f8cf189ab8d7db12d08000000000e8000000002000020000000eb06124acc4f7a7e75d28c7ef0c542ae9ba89b47b53ee5387d0f9b431a73e2d9900000009cedda3f2fa4e853c042837a23049eb697678336aa528ad96fa3876dd408e89682ab9211e32a2152397630696c5b4d3e86ba18f6a0f7d9b7f93e0b4e95101b58f0e569c8ecf3d55c48c86f26c630f9c99c46cdd9f2e12bba477e82ee6af9b2005105d51c3016ee62e447029601adae6d546119cb0e35d3f033483d87394afd9df2b30bd2bcca6949953b36c47b1ba34c40000000044aabfb7f41c0c41ef4add25b1a053a279771ce94ae8862ed48c17847a726919247a8760fb6b24afdf6a7cb3701939f76da36847a7b28393908602d4c6c4032 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A23502A1-16A6-11EF-B27D-6A387CD8C53E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000a2da7567d079bd40ab37340581509cc5cb125e72e3307b4a2d37c67f6a365f89000000000e80000000020000200000008788f63d174f1cec8c8fc7f8c541354ce9104f012b9c90d34205db12114a135e20000000856654edbfeb0af56458034e9c38f67648ccbf9ccadb7e0fc4dcdd5f73c76d9a40000000b0b11e460335fdb186f52c500d8ba65556ce37a235a4ae7c52cd56b3f516bb0b61362b3b6348310859f25c580a9885f93ed00354b2d8f66ba697e7588a7d8630 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70fedf76b3aada01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422370909" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2968 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2968 iexplore.exe 2968 iexplore.exe 1940 IEXPLORE.EXE 1940 IEXPLORE.EXE 1940 IEXPLORE.EXE 1940 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2968 wrote to memory of 1940 2968 iexplore.exe 28 PID 2968 wrote to memory of 1940 2968 iexplore.exe 28 PID 2968 wrote to memory of 1940 2968 iexplore.exe 28 PID 2968 wrote to memory of 1940 2968 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5f2299d90aeb7c7922ef189a11b7da08_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2968 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1940
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d49d2ee5112a34da230c42019337d037
SHA14fa7bae8dcddeb469b332831153afefd4f240463
SHA2560d3184bf30d3445b1aecc617a2a3a053753f0bb148c7a47ff0874d375b1e1553
SHA51239c444cc22f5cb4cc1a335f55c8ca1040e1a0f54be030b599513e791f8765bf28c14103fbfa08ec5011acf4f0c59763b8ee891c352cf1fc94bfd74c6e0162aed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504f28e14d518240a185ed495dba4c9d9
SHA16bc2dc804ed23a441c1e849319ea15a53f6a7321
SHA256072514c487e62f5da889ed26b5ef60a8ad0b72d48cf6fde1c79900f92a85bc69
SHA51230cf83571b54024604519907261aa049b04b05579f1f2ce8e70025ab47eea07fb6c02ad36098f901500e43fae7629b3d18dcd8fe51a015a9e592758dedc1b76d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533ea3b865d332291b4210b2c91add1b3
SHA17e82ad8ae8eee1b44a2fe21c2c6f6dbf481ecc94
SHA2567b9201924c5787ee3e1519d6455670600cbc0d78fc395bfb0b6a3c88a89a5073
SHA512fa49e81a2a00ad3bc2bda23d5a9e6c532094b4985701841e5f771be670f6abeaab70ba7e5f1b8c1a1d1b9ae8ea26bc6ba0e9ba6716b86bdbf6ceae1df018c27d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525cf9bc0abb820a7c9172a2dc9598ede
SHA19002424f9b1e176e4405666e344912cdc440c54b
SHA256ef54a74637b654e4969934c51010bb1bd4192cdbf845d069433f9139aed72166
SHA512bdfde845405f3b23396d8ca3dfe13ec19c2e8471a252c177cea7d54eed5532bc37023bcff384bc17b4df7ca03973d8b72e315bbe09f418d432f785700730ab0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca2a24aa2ce94332c3ae4407854ec55a
SHA136b9ec544149ae8b94c494ec0a5cad65c508b510
SHA256fa80bf0bc1e7df59697b402627bc843be0ec35f1c677670875475de06cf30c53
SHA5127fab4de7fb8b9c49516780e0af9c6808f0b2b08c1cb5361b89723266324d17fac80d90e28796b8036778d6bdc9126ab14b12d106776611dda0fc6755ede430b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9edb8c1b21fbdbb6fbc9d9ae47edd05
SHA1adead50e0c4732a5f183f59b4f1b806fa39c303a
SHA2565b989cdadf3385e74894bf488e715b5b7d9df0a7bf4d37c339dc7e391fef32f8
SHA512c9303eb0c17432c3947a2021519ed3a6dfc9315c49d5f7ee78f0fbc7e691a04b3f4689ccffbe117ef48500f24e207c2e42f1bf4ae0cede3f8b8e6b7b980710da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545994e49b54d86bcf7a1170786389cbd
SHA18d62a0050c1772749104a2a0773b92902bda729d
SHA256964382f0b3122d967e5ffaa592925b0e8533db3f0d529b9d2b4a2ebcba20295d
SHA5129da6b2a0146e61846c871b946da4aad7d014d6d671d7641e3dbd6dcbd85004d64a82478f6e645724092093f86bb7ee0b21d581d07f7e649b32b7efb3de33a652
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529116204dad3505301e2be06855efa01
SHA1c811c4702f104e8c08996b6ca51b62bcb41a424e
SHA256743bf80de6a8cb435dd98f46f594351d9242ad14465657245953301a53decda3
SHA5122e894c202678ee7311aa042bf493999f84543a97bc1803cfaba6d0abce97a8ea920fed4497fdd8d97ac7cb2f4c47ad9833ebd78d68e25f6b703d82f16eb90549
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8f6551c443fc8e556e5d20c020d7da3
SHA14e58c542c1dfea282de3f65bea7d4aa0f554008c
SHA256afdd93c34f5b71dae0bed0664063b277c022d04751aaa9c3665eae0a356345cb
SHA5126cbf5c90621f9d7eb586a673d10b46da51beb16e7eeb7a2a8130c49d14252d8f12f749f388ff8b6697d8bd9dd1407c2f38e7bcd1c753d3b3e0932810f4e72aeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a972746544d97e18cd21de6d0f14efda
SHA17dcdab3e35666f9197dfb148184bcfcd50a3aff4
SHA25647fe7469ccaa49271963ba700516f4e1c05c11eeca5eafb36d18202d418c1d57
SHA5125a3c8458a789d9fd3c90112f46060e4d2dd92d4f0f73e1d4faed0815b7531760f1ff1f5d444f6d4ccda3858a29567121cce2cecce13bc3a68befdad601225206
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5439a1b419c117159fa33e782a4cb3d6a
SHA10d919bf41f5b5e0925346b4f044fee8c7f8c7908
SHA256f10a2863fe75d8c45ddf5342fd8cd86a16b741677ddad9deb54e45d687968763
SHA512e8059e9fe0f9e7f97f29b476daee4cd23c1d11d8c63aa42e8d6642089836069869241594b332791899979c3e50bdb253ef0ab197a95b836ccee1a0fa2b48f4d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55132ed34a9b3e7f2c5fb0790708d9e1b
SHA1e10b90bfdcd1caf65065792bb949e8a3939c448f
SHA256c8efa1718db707926dac3366e126db4d38655f67d85d12a59c119b76fc815b51
SHA5128629e44c0a21c1d615826738320d3472f979927bb45a87638c3a560a13d350fc481a7cd8c3845811f2e127c4cf4fd0ca3f1c8253038079361c6cfcbe858c6d45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ac0230703efc67a533cb824b4ca249d
SHA176af09b0ab727cd80b23056dbcf9edee6e026eac
SHA2565ee99c1b0f588f524f8ab82f75dcf5b89db83071ec69422a487337c96859fa28
SHA5120042d103a6462a16d69c7a419186686b6165b09004c2df0f073d3e89272153165bbcdd46a43d8fe342d7499a20ded58b9f89fcf2328dedcae96f126ec09e9832
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5294f3bf7bc514b025442ecd576c2bcdc
SHA1c0eaead23c387c7a5953b52dcda867fd5cd596da
SHA2568d8358af18f0a83b0184e586613c7d619b4b4887c2a9e4e980f00756d2dd8ff7
SHA5120213ef76595baa29e1e3c2625e69675de563a919aef967591fa95b23f95a0b7cf7b98dd564041aa36b3cce10337dd9cf83c713b426e8cc82dfdbf182921697ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ccb1c3cc0f839067c841ce994aa120e9
SHA1d85c343798c03c828aed77af82411e479efa69c9
SHA2560447164e2f19d6cbb2611aa40bf93e90ac327c49c94e7b6530301e37fa1d6cbc
SHA5126dcc905e2fc555704f264303e44c9f1edd5a7db1c41715e14603f0d43df8c3cd8f563483ce4897c7cbd9d6281e32726419072b7dcac485672a9a42e1870b70f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c12e447e6bfd7d9c433e7fcf9fe82aa
SHA1226aa3658aa1d469f7c506d336e139a3b98b49cc
SHA25698bbff9f6a4813e138b746a7a447225c6de2cc3e3ed08d22e5903524fa4229f8
SHA5120f3008d595f1740eab5a4ff27d8335e8e75290109363d62b5101906409b78d22f8d080f6e08a437cf90546232b225a2939e38541639b68d10a74fe768ade6ee6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570400ba585a8c572553ab103b8b1ae41
SHA16dd112dd1207866d7782d8d786d738a51bd5ae60
SHA25676097f029e6d4321d0558013a12aad868a53362920c3c21a8de8d59a284d63ab
SHA5120a8dc02ae49a7a124d1679df9ae3e626c7c28de00fe37e59b43de429aa5d5f4b3330b6c82e2b64b7805445f679131bca841d8fce61d0c3af9d171e8f8c922bf0
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a