Analysis
-
max time kernel
118s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 22:01
Static task
static1
Behavioral task
behavioral1
Sample
68c7c72cb43034787736699d88a0cda7_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
68c7c72cb43034787736699d88a0cda7_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
68c7c72cb43034787736699d88a0cda7_JaffaCakes118.html
-
Size
30KB
-
MD5
68c7c72cb43034787736699d88a0cda7
-
SHA1
c81ec1f66e4b1e125ab0ee7b8a184977f55e8011
-
SHA256
08474f1e1d964dab4b5bf0c58f07eaf17f58e6b1abcd06c267a04a6d4bcc3b78
-
SHA512
0a7453a3f77a6e17c796c26db114902207196703b898f189c35aba6e368fef103022c2114b389405b82a718cd7b2ccc18588f746342b22c26129549b9bb32edf
-
SSDEEP
192:PxroeEypk5Y/eDkoMs8zme/0mJQexZl1uejbLl4vthK37inzw0ef+6sisG9RLqkq:P9fpUcPo/UOm2EqP1
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D2D20C01-1886-11EF-8E9F-FAB46556C0ED} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90546ba793acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000084b199358b2e069d9e02ae088a3ee6ba515f2924f536dfe9a97f7db9e9243380000000000e80000000020000200000009eb7da95cdfc61cbb9bc1c1f7485927f40cf73aa05e4cf641cc4b24303e1a1d720000000fd1018d7bd9dcb4bd781f660b23c79b9f1a0ec2ac7f405c47894487a7033add140000000f21bf5e35ebcc21e75f4670078188fe6f8c09b40a482d50df7a22b705c041222c00f2c1755abc94be7ae1dcfe4429d8e530e64496380cb1edc412dd235fa4f0d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422577149" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000003be8a850188ae8d394b2e28e80d8ad115d577cd4281adf294d81f1edfd89485e000000000e8000000002000020000000790be859ddcbddd48ba1a0341cf827fe6521d4f002a4d07a7fb4bf5b7db6760e9000000046dc52e7d54a4c32b110f9b5f3a4d3d8ab98378557fee87f80d9a5d17906140690d052281822c6452076180de6ec1590450c4b17f992056b55bfb1686701599e1720ffbc2672410517974a38aa04b50d60cc186cd76590ce93734b3dd2d12b05d4007292d9ae92808df61d082a9caf3a72f7d8df28ca05f906557bb6a6bbbef261e23a1d311899258abab060f0e4ffdc4000000049bf610f53f598197eb96d1917ec46a29a00a6f0fe8d09680e41e34cfdd054fb7e2564b9eefafc6da38f9ec655655058284e07d48a1dd70314d3b611a379219c iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2460 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2460 iexplore.exe 2460 iexplore.exe 1284 IEXPLORE.EXE 1284 IEXPLORE.EXE 1284 IEXPLORE.EXE 1284 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2460 wrote to memory of 1284 2460 iexplore.exe 28 PID 2460 wrote to memory of 1284 2460 iexplore.exe 28 PID 2460 wrote to memory of 1284 2460 iexplore.exe 28 PID 2460 wrote to memory of 1284 2460 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68c7c72cb43034787736699d88a0cda7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1284
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd25977fa00ae754dacd361f5727d0d1
SHA148e020dbb4ab3e607bbdea60451c9df190f42ae7
SHA256aabb87e02ee45e40d70436df0c83d84f20f2f4345d413b79e8d61c66e3df0606
SHA5128b66fb85145b4aaea7e9b10b24c670789b7aca265b9ea913027f25b877e9105c7781c0a9a8c4e7d173bc0f2ffbbd792735b537146b8d90c8669d8a73b1af7a3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56bf36b15832e636bb1774358f8e3c635
SHA14b20edbdb6374c5bacd87bc3bfa87366cea8e638
SHA256bd0b5ec61f57526ae5eba3e4196c119494be162d1ada6b5aed2c9953378135a6
SHA5124fb4b9366fdceb5f35af05f9d4e8c9a465ad33356e454d2585b6a91e56e3e91be307738e202967270e18ddd40b91e587b20393351c33d0e3afb9294a25da7284
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589dfddaea34120949d8cc3dd83b9c7b7
SHA198db81066ada49578b057dd3d76b3097dcfd053c
SHA256852bae8ffe2fce97dbe38324d2c8025f0d698120ffd0c1c68724da058a701d71
SHA512f21dc0fbca9817e3ea56df4ddc36c15c4229a4c0b5345929ad7871c0f4dd1e35dfcce60928413bdd8d9c272ecde22ad17be1aef15033c75839ff68d3148acf3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c967ffe0172eb9071bb9474ab7b9765c
SHA13f2a63923096bcf9d62b6bfe28cb6f3a498e0dd2
SHA2563d5b34f68f1f0a67e42fd6e0ea0105a5a2676b77ca31d48be21ac2f6d724549d
SHA512e8265eeec0311d034728a165d3422e7c92ee8f1c8fd4b16d9189c75431fabfffdb6a1922d2cdcfa586ad0d80ae1f9349594e748dc3d35732b3e67a285a3fd57d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa35ab3609ed229242296c25889da954
SHA1b0e46d73858a1eb9268662f61cd09456a9f4f162
SHA2561ebaa7b57a578bccf61572fe538fe764cf67d76be1a97d58265bb6c81c64ae3a
SHA512c5e5c4a7717eec1c0f7b885e4c01d4bf7ea3108c1a3677d450e513338befdae6c35a8a0424ce276564a6edb98df46addc1b26367eda8e8198432519d7b5d66d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53955c7ff7bb4d5635cf4f2c4c94beea1
SHA1d5a247418d184cbd87145ceed1055c8abe8651c4
SHA256aa5043fa9cb2bfe214edd7be5c50f4dd2f8c82294af7fa797d0e9474b34d0228
SHA5124380344b0b83ba20687e74c2f7d7774f6fc4439c02e05f523f36a2b1d13970969553ca0cdc469283ef3e3676bfa449305d89e632cd37af03d11ac4788e9b0dec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b3ca8c29e9f06201face869e42c465c
SHA18d9af3b5387f8a47a09d5457e836051234bada28
SHA256b170cef2e5376d0210a3eddd68b35b8c4ebe22a2c702f9650b3eaca93ce13bee
SHA512b43a37a97a7fad8e6fa16277e75e3c088fcd3473ba76c8a0a433b9cde601feb9d1675377fc40e176822221aa3f4e763325a6d1afc8e4ed133374b99bdad81f27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f648e9c1b608f5d7b3e6f863c059734
SHA168ebcd81acb7304f364db00a93d83a6031a495d7
SHA256ead76fc86281329cc78d1826ee7172039d8621119ac63d524e91799927bf44d7
SHA5122642181012a2556fe11bfff1bf5198b9bf47202cd1cece465b0be2abd8d60fed4711f7be181171cc2053b664bd310156d50bf12e4f3962b86303501a54f695d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb0190c87e6b66c4eefb0f17d2ec31f1
SHA15e86d535b8120fc50a9b0a8e133ecf7d35874657
SHA2564275dc2906d876e73c9be45d738b46599eb8119e808b96b5b42d37da27adb805
SHA512c6692d1b819216e333f28587159568561fc578e2b7b18c92194c57a34435d12635834b73753145fcb5f55a3af8750b6b71d97aebded28e36941908d3ed003444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5d4186d1bb20aec67548729b1b07792
SHA1009e4d5398aa96a33c50c93530d6601cfd325cee
SHA256fe0ac0c975f49867ff03db7aecb4cdb220c7c28f2696f49bd268708e105374e4
SHA5120c62e86ba971d5186c8dc0522a78b283aeb5cbae3239ffc3a6e271e9780b8bb22be928ca39a1e972d151e04fbfd845df840fa20fa90e8e82b7705d7cdb213b9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59401582569dd1015a7b58b97f63a196e
SHA1280e32bfd4788982a5dc20634e9621ba4e164135
SHA256fd88c2bd81ccb0ec4191ce6951e44428555a3f9ee57ae7dbc2b30015de046ecc
SHA5123129eeded55d0d47db84d384a0c198fb28639410a418d6248558acae1de857e9ce97e3eece4aedf7554860631232dc95644fefb1260b40c442e8244c6a946a86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a52aa767bf8a4a7ed54d8b2e03175255
SHA1e1cd2018111076ca489ea87863d255c13e0afac0
SHA256669c2657fe02a221c89072818a558f8bf9758be2b7fb5996ba59af16b603c796
SHA51217b6022e24206feb48d7721b4322c0fc88aeb5243a85773d142c3a29eb076f876f2f580ca498b4fc19d6ed97abf38a38649b429deb59c9175e46763f8c561cad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d065dd1baecfb9ef41db6dbae409317f
SHA1adaef347ddf4e1ecea5e97cc8028c2df7f6cdacb
SHA256be5e0807e5b5349a01d1ba15a29732747ccae3713ff4f6e389319354979b2176
SHA512d232f2637bced20d65e97f05c65d272157eb7b72dbaea8cfba74b4535ec880cdfdadae80bb901175b7d59b5bde0c46cdfebf6fe117e95006bfad0545685b3d96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5031f6aedeb65f4ebb48c751991922a17
SHA141437de140a15f551235c0ecb6eea719c877ac8b
SHA25666063b18811727b40c42d34f5fc63a38aa6f5d78f3370bc0f4fab0a5e91ec417
SHA512b4cb62685ecb497b30b54bf22c78f786bfa106613854ee45fe3581d56bd230fce773f6b369fff1ab188b8864d9fcd60114a0703c6b31c69fe0a9dd67e797d177
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536e3d1ebff8140b10dd1012c5ed07ca1
SHA1aff2d6ca09bbdf7fd5549702353dd9e3aa8d9f1a
SHA256bb2e468ffcf1c3dffc2cb4c5e12581c71363808fb92cf043e153d317449725e3
SHA5124b27478ad01b42aad17a0046b41f6d3aa8abe9fb522797c3b0d0c0b9baa099bbb2b31d6e919c756622b9fadc7426da89c4f93bb8e7228707da97719ad3dcdbb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b04fd519c0fb9790cf5dfdcd7d137e2
SHA1352f294eb37d58d36e4624d01ebc09495a1859fb
SHA256671f6d904ff4980d7a06c08c0998444bd180cf40ec170b5096c9d50fe2501cab
SHA5128fa5d8b2f6b3a0073958a5ae0b2eafb73d22646d0b3ad7c7fc2cacd59b9f796a48edde8f93093770962b963311a764c9bc625e6a7c01971aea9ff28a66fc1066
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1896758024a9a6c858276295f8089e7
SHA17d590ed2b1b9489308763ada109a8a4eada7c30c
SHA2563b6e674432e0198b05b3390b4e702e474f90b33dd11ab2eea4ec50568dce43b0
SHA512d41200d32aff3cdf1f44b300ccfacb94b5449bddd5e075c3aff08dda5820a2b28885d255f0ec694487c636a29f0d6c2aad39dc3d4bfdd4cda79bc10a58c3357f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551429320f982e698509f8816bec18d46
SHA1c390b57ea7415be6581de95ba07bc28ff5474a98
SHA256c61ed565eb146c38e6c745b238cf12bb084274f612d4684a2e8b523ab3927cb6
SHA5125a63774a72410277199bc3a8fbe92ba73a6723d31947f4ceb8a7a14064257bf94dea62e8c795bfeb38df1c4131dc170459267f532c8162da71f4c779cd3725fd
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a