Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 14:43
Static task
static1
Behavioral task
behavioral1
Sample
5fa28140c6279518ed45b42d21e53dfb_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5fa28140c6279518ed45b42d21e53dfb_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5fa28140c6279518ed45b42d21e53dfb_JaffaCakes118.html
-
Size
69KB
-
MD5
5fa28140c6279518ed45b42d21e53dfb
-
SHA1
b0189efd17142b70c53401202ea034827737b4c9
-
SHA256
fe5da5507b0c1eca0fec3945c14ddd77d96b7a7698bbb1d1cdbba9f7f50d850e
-
SHA512
966127c1ea4194d443df7afbafffcc88a6b7826285882f5969241b18f697e6a90dd7cb9d4c35c86a8df927908d73460bf11cb9a73956c70289a4917bff85578e
-
SSDEEP
768:JiEgcMWR3sI2PDDnd0g6M39+xoTyZ1wCZkoTyMdtbBnfBgN8/lboiGhcRoQFVG8o:JGdTSNen0tbrga90hcJNnspv
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000004b9d6da8fefe288554f8f2c962edb4c339f1576efa0c8b93381d727ff3d25260000000000e8000000002000020000000fda52d2af148ff37ecff1f2672ba6f6605bfa4c80169ad990a426edb19771f8e90000000f1aa09b949b1073633b688ded28a571071826ce91fa67342cdce065787b01f36f83ea2a1335474cb286f0b95043ef455100e16e03725d3c575cc1cde862a405c1b38d6a224e5c7517f2da34947017022ae4e00fd9960119190e5834a71b5aef90e8c229f61965dd4f88d9563f18deec127aab0027eff9744a1106c95dcbd35e4ed123a267fc575fa682f86fce1fdd107400000006a48423caecaea8c51121983b3f76fe122214f860fad30fb1ae4757a0ffd3cff9eface8962a82fcd6c1b05e11d4ce589d3e596f2546d18f4442427a8e78f6b9d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000e1f96b81a82be7b62682eee85d2ea96fea313e2fe4322af7d5e8dcfb60e92191000000000e8000000002000020000000077e0099ec98d97ff97a89dd1120edc744e6f8a22e46e6e04dd0cd36bc48ac4120000000d8803f910866ebf69f7f828f8a356a51fdb12ce6756755f3ec3bba4754988eaf40000000698143f88be04a9a6773be84ba2e0c9bfae7fa12ffbf51c0bb84062a97887c10a509ab9ab2799dda15c814fafd78c99539fd87e883203183d0675d877402d2c0 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b81129c4aada01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422378075" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{517512E1-16B7-11EF-9C17-5E73522EB9B5} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1808 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1808 iexplore.exe 1808 iexplore.exe 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1808 wrote to memory of 2272 1808 iexplore.exe 28 PID 1808 wrote to memory of 2272 1808 iexplore.exe 28 PID 1808 wrote to memory of 2272 1808 iexplore.exe 28 PID 1808 wrote to memory of 2272 1808 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5fa28140c6279518ed45b42d21e53dfb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1808 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2272
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56671cf7c23b3526f3c8e4c2233345960
SHA1c20cfaf4933be23d7ab86a64c54276f2956cbc50
SHA256b67dee4f0ea960d3f05149b16482097c3d77b86685ffd03138afb3f04557e8f2
SHA51264657d56bb34fbe0e01046185f3e14da663fdb6d69de917bc9c60e18125dab84b63a212b3731587441474b2c4e8e7ed93d4c588ae02c5992527a8be2873309f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f335363d567e266697bc788959e58f5c
SHA1a78b7858d10fde1556fc0a2c5a8244560b8057ee
SHA2564f5eff233b7ab37bf98431bebdfd7a3ada3241d7f8c5caa94210154cf6913263
SHA51243466916ba4af303c44fa0553dc63c077437f37730f6352d6a0595d22edf25248b429f7706d1ff03629721263b8bd206ad605539cbdbd1a56bdff1a7d93029c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551e0665672faa1bef03224be2ade2bef
SHA1c76054b8c0f2f1efa604bf7e3c577da3482d949b
SHA256e4a2bab95f2f14e3da4d6c78c49650eb2dcbf48db149c30c963ddda6b363fae2
SHA51206d967117e93257e01ae190e025de107527178726e04114411991c7e403bef182a3b7a567f6558dabd932e675f5c57b36e65de1be7541a301eeaec7c427357ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5513c425e8c9c33a9470cc9231dd96a47
SHA1452475f524f41712058abccde28f8bc1b9eaea51
SHA256a2df80c8630358e07160348183ebcabc60087b00ac2de8a344c3f105a983ac5a
SHA51260b018603a8384067f3ea99ab212c57b05c3e3cf7462e757caed986b09e38c20f43a806406ec1079c8036e688215b474be0bbd9e6e825f87d2ab4445fb61aed2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f9f75120420aac58bdd6edd03bec9d7
SHA1044eba9fab180154a24ee5a98f63516e199a2bd0
SHA25654d986812613feabb45a5049d2329a2af64059d4da399dedfdbf94820db306f8
SHA5128f5907e703f45ddf0a29bdb7f58dd7b691109dd3a88b7ea890b0b16c873f946d670c0b48e3f78b476dae3f0d48bcb98887178b69c0b0343b84f855fd91a34baa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4b4326abff7fdf8b0891a59454e28c5
SHA164a2fa327819da77c103d43b38d6db53ffd806fc
SHA2561ded037ea960261cddf9fc5aac00b243cf50bdfa53904350d5bda75ed4784b8a
SHA5126504c1a49db774dd34a5c811022c9ee60c774e0e1fbf5be29f09f98e9c87abc0554e24270aad80b49b46941e5da45d1c6707e2abe67983e49d297a13a11bdb17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529fd4dfe6c9a37cecd5145219b5bb2d8
SHA1c1ab2d43309121493fffeb3d1ec2c74fc2b5d259
SHA2560d512a58ffc765c0ceafde38a7edec6cef338c8f3a4a97ae483b37f377f53466
SHA512cc35760904c39f37afce620f1dc1e82b2e3d8766de795854c8d11e723b31ee66162933e813b9995ea17e77f9699c8e3d019128cca7b8f8ba148ea3bcb5c4d485
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5567fbf44b50d217771d5899b47098d78
SHA1a872909e4adbde4e7c1bf788277d9aae49cacb6c
SHA2563b69b7ccc5885b6b056b901302d1680ef829fceb8b1cdf535c0585eb9443ef7d
SHA5123b3ad970b3b15e091a1107f8ebf6a118bbd82b21a26eeb3206d7c915d2a69c0648b40088cce3503aed861b49d9a874374077c18db269e89c5a20a248267f22df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52fe43ebfa81478a6e89c05e272ec3e94
SHA14d500271d5113eaf5d0b3572dcd888eabd7b894e
SHA256780b7693860ca8473aebb8505e0808f2a5900d62dc3932ed474644318581163c
SHA5123257c1f28da51ad694059fb789710a3ff5254956da54b3b17251c74ef8205129a4d5ba7fae1bef4a3a8df0b2591890702788960367819617329159cbb9676433
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5535c2f9faef0a596c04885f53a1b273a
SHA105529f3d5d681cd8734404c17b2130af94c1a0e3
SHA256df61b9d41651dff946e2ab18df79a67bc770b01ee11ad1ace87bc2a0d0bdfa5a
SHA512761bf4d3e931f796a5aa8cb78e3cf6ff4d1a75a07cbe7bdcfcaae8db232e5dd5ec953e0ce046abe5542351cc74dca5cfa2c65a68820fec097b57d832f130cc27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1641719734bde3dde3da66de06f04a7
SHA1eb3df8c34c45bdbcdad3050e38e89de2f28c95a3
SHA2569c075b0fdb87635a5841244af0f875f8abfd4f63b7520633a64254868b65199b
SHA512daca7332a79c9a46431538d8b3cc3d6c11f5f690156c6402888b04dbe04afac5e694e26c3bc1e0a46eb3ec92390d32cf3d54ea356a2965ab51950a0cf671405d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512e23862cbcb1107840d628f3cbcb75a
SHA1f1467151a5d8169c1225367642bce87507082b2b
SHA2561844cc104dfc9770020ccf5aefafaf5022c4b469ef78567ff866a7ae162d190a
SHA512cee8e4d222d78af755ebbaa9d4ce1a39470e8194625a5e17eca2fd832098d5efd464194def44ca8a431f79934ababfaac1cf88fa72597ddc7a060e9b48ba5ec9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55698f0631c92cccca29492b83c9f5cb7
SHA1ac52b084b97a625ee5e25db63da13cdb9298b417
SHA256c4b723193fe8e049948004b3d224e5a704dda2a85f68e28157bded10bb4a78ff
SHA5124ff2ac4ba0b313fd9f78055f5dbd246bc58dc4d5ea9ee43db5dfeeff1d300d241cca3f464b1ccb1f33f0d0389a4bff2eab18622a5e9d049c6aa0995156993815
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500c59b12dae234cd5fc598f7d2c6e086
SHA14ce514313555a494a72bf5fb0e354c1873e853ca
SHA256732aba33b1e652c6298a7f0da3794e1866306a19ec5b1177f02f80621b645d47
SHA5124c11bf0aff7d584fa6a5f0916a422b0d8e6367967cae75b34755097aff8b7603f16aadfe9c750ff1a7d2711d087b561bfcaeca78c7162d21f9cb7fbbf532264d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5060f202ff1a8aec7339cd6e86503acf1
SHA153ca48f40698dcc0ee8c7c91f2b2638d9a88826a
SHA256cbde1f43743377d35799e954309c45f19df14da78fe61fe40c24007d864c41ad
SHA512c9dbc8b87da1d514004476ad2845e39ae3437c54e474363cf21384d9bedb921c74819f49eaed7a1920693e56ba3ea64454476233299666bed57a6e59249c7d97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544e2b4349240c0bc87c83d06f44dff91
SHA1757e6a1e73c60254486ae6a72ea23383c53597e4
SHA256ab88896aa11fcbdd11bcfccae53d626c70a0f64ad6479d155368709ed35f0242
SHA51229d315dc2ade18db8a0a22b5e787d86da0f5a405348891d8d5217362bb873ccc2ca86abbf097880b9ffa3c1cd05a084391327d92fdd8949380f62d6e83080d9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5394172b6671e3293e12d7442b7cc4434
SHA16bc324098971faeea805647e78f8897d5996e2b3
SHA256367a799fb4fa14db3101ff81bc7cc61c99b34e03622740305fedb25c522c1bbc
SHA512da50a8e302ea0e21e939ad32516cac14eb5b0d1c2f8cdd65e6d9108b8440e25f3acd6c77070084a2003081394f1e2a6673399bcce9dcfff59e98e55a62413825
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a