Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 16:46
Static task
static1
Behavioral task
behavioral1
Sample
64042b232f46c294f4f8e2a22243300c_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
64042b232f46c294f4f8e2a22243300c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
64042b232f46c294f4f8e2a22243300c_JaffaCakes118.html
-
Size
23KB
-
MD5
64042b232f46c294f4f8e2a22243300c
-
SHA1
902598f7477a30a22004f83ac8f809f3e1aafd45
-
SHA256
08767ff5f8ac2afb7ddebb042db86b1765fcc07da6e078ce3dcbbbb635a184a8
-
SHA512
87e775d877a4e3709809d86433e84ecfbb4f1827eb4b339b6f260a05db2afd8794b718c262de3cb93c7d75a494d393e474c5486096d21d722c2927256ebaf2c7
-
SSDEEP
192:uWrEb5nHMJYnQjxn5Q/LnQieyNnTnQOkEnthFnQTbniGnQQCnQtYwMBSqnYnQ7tk:7Q/nb7y
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422471856" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 207f96809eabda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ABE29241-1791-11EF-A649-4E87F544447C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000857b725e7b68dbb661f02ed50395eccb8abe4d57a4c61a7419b51a45678c2984000000000e8000000002000020000000e47a6285aa6a892debfb33519860225e4cd0cecca8a50fce9395dd0092cde9a2900000006b1a3dcaf4ee9ac6da3674567b9d09e1ce7bebae07a18bb42604e2ed2d17b471e96a189d7b5468d6748200bdd8504f1a6d73590d7d1e7a37b63d08c4ac151608b92ecd30647c12ba9b495298b889417f681377c6a3fab81084b3e3f5dba14b24d71b9982f07c28d5c34266e60d20f69726f1b021d8156477a7723933997bfa0212c5a1ba53e81b15c0e9ce531444c54840000000d6a572d046d0d73f98cb63012a7bef5e26d795f0a0cbcb8021e0fb589eba33b18b43a369eb93087280810dcfd2d77281d677ee0d1b90ec2d035b3e6efd243daa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000acfc116ba144095ea9118cc5f2d579f1ce8a834cd18be1982f841dfc3ea5e4ef000000000e8000000002000020000000584dd7926575af6ac9456cff54565c6b1d6ace8adaa89fb0b4ad95f4a18b498a20000000b68391cda5fe15bd408021cb230eddc8023683a77d0f8bc45425e549c6079b63400000005b0067c2cc77dd3e384d68a79a695f5bd0450e600417951720f55ff48ee532a1e8abdf9a39e21f745af0ecbe784785bdc7b3f9bf206bb33f1f2a010ed7f2b252 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2424 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2424 iexplore.exe 2424 iexplore.exe 1824 IEXPLORE.EXE 1824 IEXPLORE.EXE 1824 IEXPLORE.EXE 1824 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2424 wrote to memory of 1824 2424 iexplore.exe IEXPLORE.EXE PID 2424 wrote to memory of 1824 2424 iexplore.exe IEXPLORE.EXE PID 2424 wrote to memory of 1824 2424 iexplore.exe IEXPLORE.EXE PID 2424 wrote to memory of 1824 2424 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\64042b232f46c294f4f8e2a22243300c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1824
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c5f22af9d1acdb68b58733394085ae2
SHA112c64882bffe551cddf8d24b6b427f4f1f1a0b84
SHA256e341f80a19a878419a90b5779bb92897362ed60484221770f746727a16f3dd05
SHA51230cf687e8f6fde661d31323c4cea55f416c301807ca00c607b4f5f649c4eb6a3b2cd2ca368c29d6fbf4d6b00d8d3327905c169f432d1b9d91f43a692ed3e4b6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9035410b0a0cd53219996471115bc7c
SHA1bf659c0dfdff938cd002a992bf8a3a1410e2c925
SHA256e97213438eca12363d424796875321ea4ac127e9ae4c309c53182d19cc3ba681
SHA5123191156b1c4df21f5a86a7dab150df20ba1fc94b564b8357272d209081e9325b448f2d32c9db6c39bcdd8a6d356061388affbb531e172fb8f7e726bf9d83c96b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591bab44a833c22c6d2871772e6b14309
SHA1c150de6bc4aa153af2dcb6f6ec6c128e9069f69e
SHA256d825e9710b9906740719d4543fbf4870ca2d5b2e174bf38a8cf368f223abf688
SHA5126489a5cd91aad7e03b22d5aa7c53d07fea30c486d123a6a7f618c5e5a11a50632164fd774c09a91a6386d3dbc66594066b1072319b8e38fd04431b92160c15d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9906459d37cf8212f11b7c26c98dd81
SHA1347976571bdff1c22e489d3734bd79762b01b4c0
SHA256e21857b778e5739fa1b2b8aa029adcfe88b88ee27188de7038c4c5436b5b6baa
SHA512bd84f2a0a87adc67cec812c9f1a5befdca3fdf02494ff8df334cf1d6074333ea08b65c79e10a4443e770f9379727672a86598275b91f1b6bbcb1da860fb6c9d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b8dcad05afe8f5fd54906aa0a620351
SHA19163d2450f5158e1c9d32abd6984581860fb0cb0
SHA2564e377bfdde4da82a1ec38c62af5792ed6bd960a4c4a56915086dffd381e60205
SHA51221e60816f7ad76a5c6b5e260e1bec52355e869c6d14f24b3726d0a8c9f6fac50c509bb0bef38bb3f7009016382c23fcb58b74783f23747351791d56ea36e2a4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1a5c44ff33e1689e94cc54c460272e0
SHA1dc95947bade4a42847635d653b714eeee1eb350d
SHA2563a6357070ecdf08546a6ff207eae5c3ef93010e995fb6b923a48cb1b583c3c6a
SHA512d37a4c5718fce170f4146d69df7e2c251566ad5ef6f2cdf3458e31e02c41150c622dfc414e91689c64a6c9fa796583d3204af2937cefd454073e9ff55c96c826
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f38014b63fbe540603ab3ab12b9af7f
SHA13d4ec899098c56916d57748c7c452aca258c480e
SHA256ed405b102fa8d0a760ec130d742e45e3eb280848f58545ad2778691b76c2260a
SHA51207622aa7427577404adc83b016417d2975783862d3d7f8e3d95c54c2da871b88ede6174e45c592397757ddf7f7dd82523f2067e5293943957db5bcb948371183
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f991b30d28aeb2ac574a7069a999535
SHA19ec75c479566bfe82fa43e096668724921a202e8
SHA256bdf43036443e6556cbdb77ecf42d3073f437c5d732bcf36cac98b0082b368a82
SHA512e04bd5d7b2fb12541752d7c15721b9d53c57260f3926b85cca8e1fc57792ee350c509252df38cb8b5e44f19724d5b1f218477e2b03f993b3d333756031fe1207
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537fa8d4213ff68dc4e115366d170047f
SHA1ea3db35bf9c8b4a9c538f2507cdfafde19dbafa8
SHA256289317e269a47ef91929e1edbacef52135233feb720e6053680e9b59706ee952
SHA512c56f8bc4e398932c72a921405f4f20ed5add70c3fd4de6d3486e83b94207690d4629df9191e9eb2e804331b13298b31c2b167ce7ea2a80896e1a381d94e99575
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2c41dd70975be3abf671d65cb82875a
SHA167de22abc5e462832393dd5c32e133e8dbe3c400
SHA2569462092c54bce4c9edf2283ca8d8379195c596ae7327b7830c2f386ee85609a9
SHA5126d99185c61cd73dbecee32f63d6a56be28898d8eb2b7db68490926b0349a708f7646b97d7aa7a5c7449f17256c7c454f1c5a252112e874b0378aef28469c3630
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2c07884e8d475a71b68503dc026bb0c
SHA1d30ef774f2ab144592beddb2a16aa37dfae68324
SHA25692f57935ea40488e7dc9b955e030a0032ea12fc1809e12f85972cca453018707
SHA5128374a1c75478a5452092650293e4c6b55f32023d9be3259ae500b700c7929415725192ed975a2f562f634f5110a40a398d71a2eeb950b9743eed8da76647e46d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b79be19a86f89ce836f24f3b3fcdfada
SHA1d2d39e34408f170102bda1fb6c1f4a3aa77e1400
SHA2566e64f12510b6e75ab38141e3321ab8a3d00a6679df319ea49448ef8cfcae354e
SHA5124e043f3a061947f09526d14ad6fe0627218455eeb572ce0bcbf35ae7bf096e96d74d038aecb33c2c7e363628fa9d7d964b4c6abc9d2be9d059f143d93a95d775
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c0a00c6c6dfee9e64c9089f49401d0f
SHA13e3aa012132ccea1567e704b32dfaf14893b94a0
SHA256c24687037e0fe3fbda00e52bb3f6fbfe8819a7c521b5ee7893bb40b39860098e
SHA5124d1bfc4e867e0ef3d3007805e69caee678770ac20989e11021c03c324c153ea7af876402bedf7339b33ec46236c4c5912d391a5170ab3213b9cfc29848a0e7bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52322774198bb2bd4831249951c1586b0
SHA17428d4cf55f10025b3815430ac617ad35f403ad9
SHA256361898f9d1519d1f626327b1c9d71cd1a155eb133974c28787df95adb98def67
SHA512ccac5e078805b0bdf9dfb2c94fd69c13566d5ecae569fc07d53a317b0709d8b29987be6b117fffc77482ba14cd0ced8d4e429a2daefd7165fd634434db0a95f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535a0b7c382fa58d58ab41944e0b47c56
SHA1e079427f13f27900d86e0c24b76357f43f6be188
SHA256c927bbfdd6d9e7a0114dd5a62df9329efc91490364a54309640a9cf27221eced
SHA512d6d9438df032fe2be898682353a4922e8eec0ae6e152fb1be457f1dc19a707900c729e113bf18f9b90e4674baedc17bc47e36a6caf1958c47bdf6430ca2ee933
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d9937ecd91dbf790ce4e97487fbd928
SHA137c75ed7c49f23b8a6f98737e43724ebe2982f9d
SHA256df4f6c9aac55033026901313b1ebe5fad9251e46013457c995402ea8df7cfe94
SHA51252662cc601626a2f1b0cf0620bbc248e744b38371cce3bb6bb7b0f9b8f1ffc88135781e2e871c1300723b6f5bb706adc0370cf093c253f277e39bf533a18a11f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50311937bd1590cc6aadac12947201e83
SHA1eda01769c9435c2e39e389ef457db717a3988ddf
SHA256d73a4fa78490fb5f1e2a012020e32ac93073f60b1045ad2799a850a24409d460
SHA51286d5154bf68038ce2bad862c022c0869710f2ea7be43864d362f56fbe1e445dd8c40270bd7fe94606dec9a46200cb67a01d67f9ffee64b887af40b0d8c10f4dc
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a