Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 09:32
Static task
static1
Behavioral task
behavioral1
Sample
62d0a52795b78fee2dcee9147f0c3322_JaffaCakes118.gif
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
62d0a52795b78fee2dcee9147f0c3322_JaffaCakes118.gif
Resource
win10v2004-20240508-en
General
-
Target
62d0a52795b78fee2dcee9147f0c3322_JaffaCakes118.gif
-
Size
56KB
-
MD5
62d0a52795b78fee2dcee9147f0c3322
-
SHA1
c2a772524a89169d523fcf5bf65e7acdbd1cc3ed
-
SHA256
bfcc944128c10054184d8fbdfa3e7b2b02c572fc4089faaf90ccab35abaa7460
-
SHA512
614e34edcb347cebf6f3051dace0a279874c2a0cb99c8e6d8020db08879004313747f9d2afc0c315b9ab8785d245d360463730c64a82921231d5d31d9f54a8e6
-
SSDEEP
384:sMiqpafVrmbIO8NdMAULghgwn7dwtK57CMQ2RRyyVM2KiIHS37wr5NPQo:riqpIUQo
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8041a5d761abda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422445804" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000003d3bbddcc075a9d453d7b50f135d76978eebfee8f75780f4c9703b010d262215000000000e8000000002000020000000b8d2cdbc0516aee8172db58455d726c49c2c6e8a68e485f5c664b1d0e83d5b3020000000d29414f23bffba8c1b0dbbe1b2dcbe7ffdf44f60dbcc797941ae00e14bd6dccb40000000cfeb5a24c747336f9ff8cb78db976bf1eb7ce2047033031732e26e226bd27d973dcc5febe5e26963562ea78c028b2461524fe89cf4b7f8004ece856ca256ac00 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0313D0C1-1755-11EF-805C-EAAAC4CFEF2E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000007f5e6b03d3ac02a5f3ce1461f1333d35436913e31fb7ea6b8ebb7a959b534e6000000000e80000000020000200000001df18b4a7b9e4e2dd6a87ca9ff5fc1104295614bc18670aa2a8521b52719e84c90000000cfcf1ed827976fce776c173093de0fde9980730eebcbc9026a66503291f9b6e29fe75082e31f62a7549011cb7d633a2d6c593240231a9e3334a0eaeaa2776d36cdde448c5972d693a541251ab062aae14f3ed65381292fb227b2efb85d2fd53639d5ff3a812021fd4e76867bad569016729d04d2a01747633769740539824e65ce8f080ea6988887561252cbfb9e912240000000da5701511f25cc73868564b7b04ea147fc91fe4fa1703544b65bad00508498d74df1534733ad61e2a039f51ecafd3566244c9e4090397c3a90941ba1ca3c8d68 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2084 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2084 iexplore.exe 2084 iexplore.exe 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2084 wrote to memory of 3000 2084 iexplore.exe 28 PID 2084 wrote to memory of 3000 2084 iexplore.exe 28 PID 2084 wrote to memory of 3000 2084 iexplore.exe 28 PID 2084 wrote to memory of 3000 2084 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\62d0a52795b78fee2dcee9147f0c3322_JaffaCakes118.gif1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3000
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4e957bbc602728f9c63f785c1813f2f
SHA163fef8b96c0dd87b8611ad1feb9e7b0b58c793cd
SHA2566c2bb8aca01db5759c6fd406a3f2089213f834ccb7d5cc4e33f871b8620e9b6c
SHA512c732d117c69e1da3d9a54895a8d33c1f8974a0c95d08e6055f9d09a2bb4cf9b5a5c2922cd659c9a7221a8315f18248965a5ae90c0cf40478d5f296016e989e69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf06db3e7efcf348b771a16379688ae9
SHA1100d3ddffc8b7832a6c4257079ec0025d934b14b
SHA2569f9a78c443e580bc32f496c262ca57888e5b5e68c227fbf53c39eb48edb0367f
SHA5120b5bae577d0054aefb627fe09b4e2d79b14578ab5863a1c37f6544abb4ce51c6c85e57ac53572ccbf1669c2158e3647cd0ab550cfb6b9e7d59e93384995838c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be1c25706311744034fc23bc675ab8af
SHA1e6ecc10db441fbe9608c71e5693861499b44b6ff
SHA256a08d096e438642905aa9644ac5e488fb75030c25177664ffa4578d7ba9984aaa
SHA5123f807f9bb19656e3448221457b1f18083bb716607f84cafcfea92d4a10f014e4e2d47239d79fdedf77ebfc72787cb6abab1c45e314b2cb8f0e441e9fcf23bbe1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59aa63c4d9877fe8b94ecebe7ad411fef
SHA18be4a88db65614b6a4f940e9b6ac87ed94833509
SHA256cdc5a8e01eafe7375c61f7bb846bef1942fa383710e3968d1195f91d7e05638f
SHA5126919e62c7751fc5ddeab589d4031d2589f08fe29c159895f763811d4a13a2f8e85f10a81daff0e4b34b1a2d3edc7a7fdef06361ffff5aa67441f48a4542efe57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b47145a803f0463c8f223c4f45629df
SHA1fe460c80cebe61d1405c0f369596a0d7476c4038
SHA256a8ba5c6dc5513ae595159e8ff2cf8074220824947579dcda435c076dabda662b
SHA512fd689f7d3edac416049eb4a84cfabec93edf4976073d1b15f47e418a5c0c05d230a7abc84f8c69bd0106063a419257b1be04dda948346ca6a858171e86e1d055
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58fa456a9717e0ae265d4368a3955d7ea
SHA125ddd8d72d92e282006a4d670a322401227a9148
SHA2565f191dbc6a091be9a7cfcd1b27e3aa97d0383e1e7ec87d662e464f64cbe8ef54
SHA512c9326960a6f92e5317004ee3735d4475ee09c26a66be5695bce2b10a4f8ab3c9539dda8cb660857f984ccc8d6753a942a3172cc399cac6f73a36294296960630
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500acb565582ef74dc28037c54c070d6e
SHA1480094e61a29be4090b0b82ade90ce4de55e640d
SHA2561b16165741f3e80ebd218804826c0641c179196f64cc0d3ee29cd499ebf575ce
SHA5121e0787e39c40eb7b0abc442d5160735906111a0d9686379e9be20817753299a1a6f729d59c1b3737fef9b8bbf25003daa54c969bc05df4cb9974628510af9ef8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516805a62a3863a72a8f5602b2c28283e
SHA1e70b5108bceea7db67c1804ca990ceabfe19b0ea
SHA25647b53f08115fc0c06289ffbe298453b18210e7e555209ff80585b2050d16cb43
SHA512d1a3c8d47c1ad7f92cf0c568d48f323b91ca9df4d8e2fee05db7a6627450e3249d812a3ae6862c03269d090e811bb34197ad720cf0d90d7b8569eaaa0802cc70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5404cd1ff527a12ecacad4dac2dc892a8
SHA15efbd19d4bda7f488d416edff7ef5d5f68ae99fc
SHA256cd082c71a952428ec0302a7a4aa278d1e59cf841e2feed9e5159aa4660e2fbfb
SHA512c95e396d1ca2ff1acea62c1f5c74a71bb9b00f06179c062c637a0331770e03f52340af22a54c5f2fdfe6f5fff05d6f2228fc68c29fdedd0cf2f54fb59101c407
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526752ff0ef70751dd47d2d3421603c9d
SHA12ab1f86aa5f72c56b310145b008316e59bcf24e9
SHA25667e117cde800ed9dc0bedaa8ee519edb540ad7cb84165682630f0f813d3eb813
SHA512f36e07697932f92471c56b31de1511bf71b38e6e6c40a314e0b3f9b2fec4a2378af9286b08ffa9fc4f5f52b12af978ee7b889b0b5cacbae56b88674ade0a85a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fed4e74b40ceef1a775089d937dc6ca0
SHA11d3fdca8aa26862f5eddc71b29668b7a3b9cd991
SHA2565c60cd3f7e98194204f62bc67fc1e6cd4de4f1ae730819e095efe7cfb567a476
SHA512e0ecc6181008ee39a452594af1e69be8ef75d7403bf610c17beb8443243d4e85854e52da33516a5d50d6f4f444b6ed0977d51f8213a3456ee96b94b319c2f71a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a1ff76207d8f494e1a84dabb9778cd4
SHA12f56038a44ae40f86f6c8e219329193e325b278c
SHA2562a3c448e94e465ba782b154f9d22a496f8443b3e34a11800a03bbfd655b49d48
SHA5121a80a68f24a558f56d973f56d0aeef4ce717b0590f566a66b8faa3281d84e9c1e9fb9b9033bffbbee8bf7014923cefd267af94c82ff01d192062b08c90de06b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5923488e4dc6a6ac903319e7f0155f05f
SHA1cc1ece95f71cb894b5badc0a0a8c97b260a29738
SHA25663cb3deb64046242e79864274ec347921fb2a4123cd75aa5461af3c16dfd1321
SHA5128194fc63ef456fa0a6d1fd904c53090baa03f15740b0a2f29e8fa082f15315d8805feec61b95fc91cef03211f4b507ffd14b5d37d243993400ed198b4610ad4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbcb3ab58f728f66fba55f2634384520
SHA137c996366fcc238da3f36dc38a551b9b5a139e9c
SHA256fe9ae90abfbaad78ff60d4e2b0204e83d8b93fc24ab122a04f7f3dc40281211e
SHA5122022f1d9ab97dfbb494963c7530411eb6eac884a456c792e88a5067ca0c3b9fdb907b5950fe28356eddfe1b0f583eb56424726a97709e793d82981354a9fb9b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50cac3001e87d352f4ba7d3b0acd876fd
SHA182c8fb5d52528e13ed46c206d65bdd6712f13a52
SHA256509daed89c0b7bcc612c44ea5966ffbd20bdec48a59153c1a12adba58d96552f
SHA51293949d09c6175c1ca2dd411827de3cf35d03a6395ee06c1666ba0e57884aaf929d8a7a74203ea614d0430b909cb2c1df96c0cf507dfa63aa1886d983d54e4307
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510b41ae71a97010bddceeeeac1567feb
SHA1f31f2ff0a68b5d7ca4a21b935e1286edeff33fb4
SHA256717312ab2fbae7383cfb2defb0f8fe06fe68a36bbd3b63cde3d6181f1711c019
SHA512933e8bd1ad217aae04bde72de065556ddc5692c0676068f647e03abdceb4b7ce3af1a248954f61f103f215bb85b19f4de969dd5ca482edd4f1c53d810e7a1812
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59df6aafa7521307fb673bd72795b121c
SHA1ac3f40b1c7bd25cbce18696d987fec10c3a13db3
SHA2563d0857735bd6bc5b9258032c2e06bcc2c6a1e10ba5da43145704f5f77b2760ef
SHA51222ec2b6a62b28f5cd920b5e3839d3e8830129fa6eb231f324aee95db2bc4c389d729b11026277f9a903c997710f9f96ff4ba2547bb5bc2eb282960c016c2c5f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544bfef451eb8684f35ac32e0855a13f3
SHA1136a50fd9bd26e2f4fdd9aa0bda68bd9c2c28767
SHA256def88e28ca2b169f96a567736615541f35e3fe5d3ed3ca79f89ce7556559c341
SHA512ac372a272cb3f5c4e95349e36d77d4b682ccd0eed10e31111cd067e821a083ae474d0f66e8581f9f1787a977dd34c2b51fbe59e74a2acaac7dabf72af95c8e50
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a