Analysis
-
max time kernel
136s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 14:44
Static task
static1
Behavioral task
behavioral1
Sample
5fa35826417f614288f4bf663f8f6336_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5fa35826417f614288f4bf663f8f6336_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
5fa35826417f614288f4bf663f8f6336_JaffaCakes118.html
-
Size
461KB
-
MD5
5fa35826417f614288f4bf663f8f6336
-
SHA1
6aa72c367680f8f33bbdc59f6b0fbc6973c2c428
-
SHA256
2d5efed78d170bc976d39ffe3fa6666af14f8a2a7f5cfe0815147c3027240638
-
SHA512
f4955a08e841798068a87e4b79be851ae545cc7f0fbe196b612bd520c45521700105e5f746fcee90edf9c53d64ea4c0d012b748d329d489a516693e0eef20829
-
SSDEEP
6144:SnsMYod+X3oI+Y9tsMYod+X3oI+YtsMYod+X3oI+YLsMYod+X3oI+YQ:E5d+X3B5d+X3P5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B4DECF1-16B7-11EF-8706-CEEE273A2359} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000bf23092462055a7beb24b13c0b9961a7d23ee3428c7a6f83bb128fd9b39c44af000000000e8000000002000020000000c2f31f5ee3b7d97f27cd1df65a2f06abe0a953a765045ebfee4a41666e22110090000000639e6fa897950e8e36246da89e982bb437d338ee0a2c5279cd76828760034e30e849c552029b267aec0a191b1ee9a68654efc0792fab76e4866a67f7b005f1b2bdb77d33bbe3517cb8315038c5adbe3825eb33ecb83c593ff204f935d1ec09b7d5f8bbcb0be9b2b7c91582cabfc4c314137e64335ebdd3e0cb79310355358e8cddbe081b39e1eac2af813c774bf4fe80400000002394e686f93cb5c7ee1be7f9757c5b748cb490dbd52d0f195891b61a0d2c16bc7ba470257304fea260610a5d94c102a5fe89795871a17459fb72c428d284c057 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000005dffe77c0417b9372c0ad618cf4b39b65757864336781ac3a9391371f2ca6b3e000000000e80000000020000200000009a63d5a8b3993d19432d416cedc6ffc91f14e106bb580c3ea2bf8fcefb270d6e20000000363920f08c5be9a22905395059b22b72f7421f441df162fdb77a59e776df1b16400000001685fd4d776f0343de5b3d71762d72a59991172e1a25cf258224183707bc6880715ce6b26c0c9b4bb238c517605b8c9a6d55c7e48b42cf6ff7c2dc23fe278876 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 309c4444c4aada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422378120" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1612 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1612 iexplore.exe 1612 iexplore.exe 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1612 wrote to memory of 2088 1612 iexplore.exe 28 PID 1612 wrote to memory of 2088 1612 iexplore.exe 28 PID 1612 wrote to memory of 2088 1612 iexplore.exe 28 PID 1612 wrote to memory of 2088 1612 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5fa35826417f614288f4bf663f8f6336_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2088
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59700ca8efb610671f69af91385620e67
SHA157e45f31f565e3d5bf40d776ac3dae77417c158c
SHA25606761daf1a8160e5a3b2c5af8ea18a69b423753ff372c5e3ecdc8287f8b916ca
SHA5123131be765f3daa71849069b321f34b45769d32852cf9b4225f77c8a42ba5743c799cc82d9ac76eff964044d813ea518955ea949cdbaee21e71c2e165447563ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e45f7b244e1ff3d8685e5b8c8cfde3f5
SHA1e249b92f68e3e16ab8fb0134572842c8fe69ab61
SHA25641a65317b99034b808ab31cf9020375e60d88dc5fba7823111042bfcd7226f6e
SHA512bc55f306387dda58179d9d2ecad9c198b8e8a951ec8ce9b43deb5bbeacbc753f4c7cddf00a2cb98ff8c293f607e3e0c6faeaded038c459df517185f2277b0810
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4007983e08027630972e997a7a13f22
SHA190837f15a94207fc984bf1f1fa0ca11ccd5e8e02
SHA2563bb5b715838eee7667b7b4d4a9b689dd710ded1c726a301e5b31769c8bd737bc
SHA5123c9bb5417bfdf9c745e54a5211f4fe30c4e88a2ba8697f066fe8afca0fe44ae7beb2f5cd233deb7b543119c0fb15cc07837677aaf845da06a70865b33c030bc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59674f40e6b78e9f90287ec7680adbdab
SHA191f1efc6640cadcbb4e32f4856da4b198379bca1
SHA256e1a88feb3e821def6ddfbb72e2a7fc41210f089bcda55e3576c1dbb9016f2046
SHA5129380b912240cf138b6b9fb2d7a98c47b9eb5c878e67f13d176e8c29b8af4f17755277b0ee719cee7b30ab701d987d7d61b23a402ab750869522c88b82649b0fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9711ce118e2e4d9f5633066ac26ecd2
SHA1af3ea103c30ad7973a7fb2143feb234af97de5b8
SHA256d4946f6ee716856f54d901cc1512839fb52a7ec2fcb41d52397b0d1aac2554ea
SHA51208fe2073ae67786f3050e4778907014101ecf18e205b86dd34e109e88be2a32699f9a5deded22f2a408e686765a5ce7635fa7bbd2e3cf3be90d3b2efe438fbe3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d098691344c7f61097003f68ef199eb4
SHA185258e1e9fc40247328e9a311f1e640bb65e2a9e
SHA256393814529fee2fb30887aeeae9ee1ccaa2196b3bad5c077001db47495ac79176
SHA51210c0d6c96776804767512ac16dde1e096921ba6a1ee3ac2c8667a6bd6251749a097e360e8f24a0c0ba4a8f4b63c074c05aa6669b0e5c18c4dece0c4839f2e5dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560b328cb536ea37580bd55c5036374ed
SHA1939988fb1a010a76997c2d942300ce4b6d5292d5
SHA256a8582e0f8a92b7ed06c4c91038235ca41c9f84339a60fa278e4fb60c9fe88c8d
SHA512331f41bedb3525cd11c94bf47f04d182ae1a3738b7cc6396c6cb199593ee9c1c588c8924513c14f14192337f552c214e6c70e55435cb8f6e130bc8e8239f2879
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2a477cc398a4b2f60c9dc1661b556e0
SHA199e67007cca1475497c9e3443e3d88766d080bd9
SHA25613b903e943d2422f8226aa71ef067a8ca96fe34f9a5ae2f5e56f457a29cc1e71
SHA51243403f3279eaa6abc1221c0492d9ee30a906f227ad4bb5116ea8a8566b5c75dda41683c4e8c696164b0720e37ab5649eef4bf011d99c8168414bffd353b622a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2df02db28c02492efdbb3cd7a086fb7
SHA1b521bed03decfb568396d1026b5450ec9de4e4cd
SHA2569483f2bbe6595da38cf53195c82dd9be4554cac433f1853a5f80a9a2f152b2e3
SHA512e363d253794e1d018f0c8d03743adc5501e5f9022fd8607540193b0d5112831a425dc87f1cfcb7285a8f56ba68434aa464a0aee58227c29797a348861852b239
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5200d4ca644088e1c86d4a71f99b61efd
SHA1d9af9095fb52bc8ce130895337765ad019d6d54d
SHA256ba944960064e5bb3932e7c7ab72bf199eacb62cdf1f3f7b80cb3c031bfbd3086
SHA512d941f7851a7391cadb876d0e8c8a34e0d93add1df2a32a8f4e998622fe9ac78ba5dd377ac6537759fb649ef7ffa3a666beb524792213ac90f4ec6c39a5a2970c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5526e5e423e2976be2b765c1ea27db37f
SHA13e54de02635f681e72e14e3c4dad41b3bac3107b
SHA2565267d9b0df13b5d19df8bf20a0cc4401ff190dd9f008e5cf8f9513eec4601cd3
SHA512096e46a507fe433acf69e1831ba4de86c7115f398cc8a6a5d1692dc75dec0b1530dd4f9f1206c75afdfdf86b31e6a388e4c2a9d05ad830b47e02b5d38130173a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58af0360b4e8aee18194a7ddc4aa6a66f
SHA151791aa6df5e0ad65623343ff3e579ef99859edb
SHA256e25ce792088801a5cacef69480c36952369fe643288abf6dceb613a972989d00
SHA51252be94a7dce23957e08a57263b49b64399807bba4e0ac69c9e2e01aca759d4a148a0f626760f9e3e673ee7f4bb4e0da47b0069a7afa7d2dc5c45b2744e282216
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5670b56a1839214d2097dc355fd6dd17e
SHA1de47e2e2e2ea5e5ec4c5870323c6f1b854020c0b
SHA256ad19a3551777f0f316f13f7077732dcab2f7f81c77f435448ffbe1648e14eddd
SHA512768a88388897a1b898a631a8a95ac38ebbf621adc0bf171395d04bce995dabd9722af5afe1d3c5efe6072803fbbba9a29597d4a6235ae8b57cc4bc3c62dce2ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8fc3293066e09d6ac1c8fcfa4768196
SHA12bd2cfabd443f0627118cc46880f7d9be7a8e347
SHA2569af50f59c100041e806ad442602a8a56354ab6cd50cf5128632b972b7767bb60
SHA5129a1199366b47274f0a034e52ec3a6efaacf29a4426f81ff5c3cc2358093e34fdedfe4c40b11f6c191c6ea7ce92f21205884cb63e449c196d54151dcfc9686d6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e26ed50f142fb91076130d02ef855f4
SHA12b0f9d9e349558d49ae7324980a06f4d1d46ab13
SHA2566887bcd5f6e083a0017ba41cffd0310d5f7ea31f78d7b7e8ec7fc7426debab87
SHA512ac483875d1823d84a1dd60d2582482fce1fac36d492166c090487d4d08fcd2a609afef3992978eb88d57da9d56b86f2cef4264461190ad0d0540cc82ee010422
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b0ff24387976b16e10b098b5c7c0cb0
SHA10c53d36f2cd83f6ea74086d66921f964c327f955
SHA25649820490d2a8d187fbfea8d4a8f4bf5e7751fee217e5cf4d2e89404751a4a921
SHA51276386bd1ba725a1537336b52dae7eed7ee686981e17b4c060d59880422ac029ebbdc30b3e402226c56ce42d118b531d06bf3c119f141a412d077f937e722715c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5387ed1124ceddc8c7450c1c3924a6325
SHA189a7ff6626b2acc11bc475e100158c617d5002f4
SHA25636a4d3a31f0a78c04adc4141412c55d5fc673f9d2ae340990c6668cd9b294dad
SHA5121d483c26e1de94741446717dc2a6961a0da05c09136e1b0ccacfaf5b8714eda65a2d8be60cc3f58437baab9ecb6b40db3858ebeb023cc5f94f5717ca3ea17e35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df47c6e8f2ccbed1ee8b2e131bbe7fcb
SHA10a8322b514d975eb68e9aea4392502703d22112e
SHA256346d7854095f7433fa9753ad2eca07194039ba725e4f8df9dd51c0292212d033
SHA512ef9684533070a819c2b056226202495f24277edd0d2dc25afc189cc8de2d89410119541765a0a33279c8f2ea6de102a3f0e052c1391f634417446c5aafa16802
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a