Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 15:41
Static task
static1
Behavioral task
behavioral1
Sample
5fdff504371ac5e7da6d50854e5a1b74_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5fdff504371ac5e7da6d50854e5a1b74_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5fdff504371ac5e7da6d50854e5a1b74_JaffaCakes118.html
-
Size
23KB
-
MD5
5fdff504371ac5e7da6d50854e5a1b74
-
SHA1
1e77e23d73cb6dd5aac8af242e4c5d6143fbf7f2
-
SHA256
cc37a6444e44175aa529ad8843321d129190f979a8a9057cde2639bc0d3d032d
-
SHA512
85ef01ef243733ebe399d3b51d890fd6fa8fc2f52df7dbd8730213700c471a11c115e94730d85f9d0c0a3e26bc5aac32be98f0a289fa5b05ef847c1beaabeff4
-
SSDEEP
192:uWburEqtb5naarnQjxn5Q/NnQieINn8nQOkEntnrnQTbnxnQeCnQtiwMBoqnYnQD:igQ/WC+p
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7B3748C1-16BF-11EF-AC1E-72D103486AAB} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00a9ea4fccaada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422381581" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000421c1d8afd323b4185346a40a672f01e00000000020000000000106600000001000020000000abd9a8deecbcd3b4a8eebc5d47cc8653a86cbe48bd2ddf13dca9a4c2b923f906000000000e8000000002000020000000c664d9f34caf918aa2acb28367cafa281d4fe5ca96a4eb9f5d71f506629e0c9820000000a7c9e9a7f8ca9b53d0c56c046dc7f1cdff50a4e2b13406d54e09abd86614d50e4000000057f688c8aa228013951ae308751c05db68953b9c1b5af19412e72f925c6e2f1536423f09c60d8ffb0342603b239c9b62c3898b36aed9cd546a06fcc0533c03a5 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000421c1d8afd323b4185346a40a672f01e0000000002000000000010660000000100002000000045d9d929c024c3b4af79adf16d6bf2ace573e01627e468144fa25cf69fdec363000000000e800000000200002000000070184307fbf748483bba4147b1b33478bc0e2d824b47e0e1533c3fa6fa79730e900000002cc4cf055093399da789a0f0e83a9c2ec5096255d0ad9951242f01992e41cd348072a5eb7401c9316d00c17ceca11b03b328f771a115e8c46fd4f1e0b5a97e69b97d3647e5ba9c8245acbc48249013e43dd152e74949c3c57319aa0181bb8c08e9faf9d30faf7f05ef80af7962ce5437e2a292a292b27bed1efd20757ba814526e7832a36df611eb6ea3fa7dbca8c6f840000000defa3eac0f65a11b59ba23fb1f1ba298f3a5959335147a94dd59a8d39035f84410bff61a6a527624ef4584d2676389805a6509e4ad95acefc8921a0c0c33554a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2264 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2264 iexplore.exe 2264 iexplore.exe 2196 IEXPLORE.EXE 2196 IEXPLORE.EXE 2196 IEXPLORE.EXE 2196 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2196 2264 iexplore.exe 28 PID 2264 wrote to memory of 2196 2264 iexplore.exe 28 PID 2264 wrote to memory of 2196 2264 iexplore.exe 28 PID 2264 wrote to memory of 2196 2264 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5fdff504371ac5e7da6d50854e5a1b74_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2196
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD52d69a84a7b820920984008921f5470f7
SHA1bff9d37df4e61bf0a3df7551b5c5a93079577255
SHA256e1cebae8daa5a1e23450324a7af3ef1b1bd15b3264904cd4f2721f6ce0db6b6a
SHA512690e605f1fd8fd85164bd8908a8e9469599590915976247ed38fa3db655bb9bf8d89cc6ee765f1cd3c2f83648ff0e180b55eb08f954eabeddba86a5fadf117ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5162a32267d20d91781a02f8ae1001560
SHA1cea20ca99ab98fc553c5a7639d56b29b20fdb4e9
SHA2564c8c3f05dbe8632fcffce9569e212acc61fcca81b591968af12d23cac7ed15d7
SHA512341dacdada4a33dc19c94664c13d2dbdbb39d12daecadc71bf51b7bb2e88ffc0c6f9116ca7b1111d25951e1347ae2c88352801102bb8e746aa6bf61ef04bc7b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0fe2e0a4433ad105cb4914e628d4bd9
SHA1869b1776c9a7758c3b09981cfaca6d1718bada7d
SHA2569d70a2f70331e7c9325a08f4ab36e55f239c9768d0385831d9a659513fad83b2
SHA5129cac3da534cc421437c99f5f16b80d9dd2e8cb4124d12f6bcf99c04da21b69ebacde3ab9033766680cdb5e7574589b2cd598eb9d306cd68f9a58e492995542b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d33c237771fe8a5d0b3175c61abcf13
SHA16666f7fbb5661f7656ad19c87a399279b6682a74
SHA256025bd65e7074ecc0b0a8f06c8357f8a6690e75b1975e2de76277caa92a2ebf7c
SHA512eeda21726a1d3c736a555d18f5a8988fbc815f7eb7739b0db1dcd9ae759974548bd182834472ac6ef9d196cb2a562f8721ea80147dcffff9fadbcaf8466bc141
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579029969314e040b17d966f08c9849f4
SHA1f89b6573143e1584140c5858468120c7217fd482
SHA2563ead7715ea6fd211e2d1caa25da3081f8bde8e635ed84a6994ed8da9e6bf41cf
SHA51244e194dac9f2a841f7ceed2ad398c68bfd60ddb0f0bd64173a5fd043720fea00eb8a77e25dc17ba877281100ef7c024dd583dfc4f43ad30c7fba38404031a148
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58dc20656964aff1bacd3a42ae1dd62c9
SHA16bd10c06d27811dc02c76199755541f0ef887065
SHA2569c56c2c008fdf39d863acb8d250218920faa5d546c5fb2e9dd6177cca5a75540
SHA5122d64ddc8db6ea8889e204bd50fce0283490826985ca36d7ee3478a04652b6bec0a0e6e1f0e444ac640aa7825476a0f7c70a361504d9534a7081c87a48a36a609
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d0791f75378d5daee37c92cd06525da
SHA1d4d35976f6a3dd960fa35c9b66f06e2b32c44847
SHA256e78399d7ce1bf2303d6a4c5ba7c5b28276294200e06f91fe400a8ae575e2e744
SHA51257f604f456aa36cc28138f9cc1a60e5f40e725e4348c80b68a32745711240e30a27bdd7867919ee13037707de15f757d1522aec8ace8bb40cc68c1432c150f30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59180a778ea650456f47d21e046a76354
SHA1c302edc7802c5ce8c2989f88ae245c39a758b8e6
SHA25630e6050a619408cc5675ab5e1708751f18bb2181d5e1bf328fb015bb7d4879b7
SHA512877329e2156080055a1c2efbc8acb53808dcc4682566d0e1be92ca62b8e4883aef5ec552954ad02745e4a0bb4e91c259cc68b4c178e92fcbaa555b6c109a106c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b9ab7bd2548150db6c56640882a3f9e
SHA1529801b466c5ea34ac6c42f492e695271f3d8c31
SHA25668c01d59c08295363138b9ea363aad9bf397eac18d025194cc35f8224c2cdb27
SHA51208678dca15fe399eb6054269d7e1ad05a7584f280013034a93b21833b2baa84c31bc84b53e2ccbb322120abec5fcbf4494bc8c393f9aa0929596ae5ed899cad7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575a27091890ab336bd85a20e6d86460d
SHA1858acdc1c54aa047d5e92a43e675365e2ff36fd7
SHA256f96d46fdfdef103b3933b42734eba73c132bb7ff96c670cc38a9b34b7dff15e2
SHA5123fb8fc3ce9f0dce5935c92198e1d8041eda60649a98dd445fe28072a32eb4506330caee29ab7fea46a24fcc90017fcac5b547127d0a70f20b091630df3f04db9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508c58f69e7cb9f571b2f8070e6c147d9
SHA143767c0aff71544b8f988ee0397946ab94c1b2c2
SHA256254d4498244361950a25a49aa77bbaeb1bf3794b8c6570f8e39369cebbc67667
SHA512ca4f64d33f141234be65305b7b36253508e03e6e1727cecf095df67936cea833f5e43db64bee688a9c6c7ad45778ec9998db4bed647d277bfa6efe319fbf75fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6bdf02ef12f6e9a10c072f66252b001
SHA1371d4b7345bf15150c3b2267fb42379a1bf0ef43
SHA256e4e78c1ef6f88aa631901701afd7cc81ad7cb9f3264270bc0d461a8200e844ca
SHA51277e470c83cf33308a2a878e864a33df39cce59f35c262a971deb0cac585eabf92de868f392e43776cfdf5786fdecbb8ce96e2d19d88e3219b0137626d37ce10c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD56be893098a931abea3cbe5019f6ce7c5
SHA163798a9c1c144aa3bf35b6c6a8b7c90676e879f8
SHA256348770b2da6659939c71271724fcb582837b8ac540e33f0738caa71dc5dd0048
SHA5121274e4d0afd42a268aadd6c557c617f1b72fe7507b7c03f07738cb9ae9b1b8ac7e1e133e3d07489b0717502e0ca9ded039b659a5c1c4148700e456a75f4e7f30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a