Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 22:38
Static task
static1
Behavioral task
behavioral1
Sample
68de94cd33ef0b0287acee28e066aab6_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
68de94cd33ef0b0287acee28e066aab6_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
68de94cd33ef0b0287acee28e066aab6_JaffaCakes118.html
-
Size
21KB
-
MD5
68de94cd33ef0b0287acee28e066aab6
-
SHA1
e273d8933da36769b1dedb915e75dacf575c0b23
-
SHA256
959b8302143f26a406ef453b06c58bec319fa0958138862b5e020a1a48e4cb3b
-
SHA512
b286a95aab39865794b24227e8e8afff0148b00c4e36ed8128085162860067e931f75aa24737b80716439bc6c000b4954eda72d1149ef3e05ba34d833aa3c82e
-
SSDEEP
384:OUcHYesir8Jf6jIBIxRuq1WZOKmhnmF138hmVCpm6MyMXx0hEzwlOJ:OHYeH7jI4o2G38gVCZkx0hEzwly
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422579353" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F47DB2F1-188B-11EF-9A4D-7A846B3196C4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015e87fc80eaa0a4b9cfd4616b4efe15f00000000020000000000106600000001000020000000bc673d477a438aaef79bac46738c6ad596ce881f2ab554f6e53382b18bdb7831000000000e8000000002000020000000c1a737376027377a76214617a9c07149bf08889765325e807ec9f329c737d9592000000060991f2bf712ecf7b7ed882733b65529910f95722336103f7eabe9b87d190679400000005193f4e30a0f6b284198589b696f33f43c5ac869039bbca6fd4d4f5bf67dd9f605d0a0d49d4c3b6ac28c70c2faa31784dab407c9ca1541d605dc7a645818ec83 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60e137c998acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015e87fc80eaa0a4b9cfd4616b4efe15f0000000002000000000010660000000100002000000063990a4ac6dd4e065a7253c23ee934cd76909b8063a7b30b4eb8b6499cd9f6f8000000000e80000000020000200000003ba9cb9251677f73dbbec28e49b8c668c241a9a2894c5ddad314cab7a43f7fd59000000003c83e9a87803345503f7594718a7434b226df0f12091cb4a1f240fd634b67ead3295392b4cb7fc9668a9fc4743a820d337e2d2c31079e7ce35286f221cc04c642dc2542e382119dbb8256e450724f918714352d0d3d5971ffb175f7eb9bef606b01bcfdac81acbdbda5de72f22a5221fc55866bb4d08f55c299ce9af4de986d3472a753f83944b83e4d4c9d3a0f312840000000d737054406fa6a3ebd0ae56aa16f41200babc2759781a54c3ff32a0830014ebdc9dce64cec839d4415996d8ed3f8ca3a16a9e14b3f2286fec753ba71d2d8f8ed iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2280 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2280 iexplore.exe 2280 iexplore.exe 2480 IEXPLORE.EXE 2480 IEXPLORE.EXE 2480 IEXPLORE.EXE 2480 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2280 wrote to memory of 2480 2280 iexplore.exe IEXPLORE.EXE PID 2280 wrote to memory of 2480 2280 iexplore.exe IEXPLORE.EXE PID 2280 wrote to memory of 2480 2280 iexplore.exe IEXPLORE.EXE PID 2280 wrote to memory of 2480 2280 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68de94cd33ef0b0287acee28e066aab6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5993b9ff58e41067f9b2d6414eafdea1c
SHA154ab6afd108352404f15d60980d349d2c070785d
SHA25600c47bc989d3ff4158ac483763e2d4d888293689d03987924f7b69e92ac6606a
SHA512f6c161ff015412493295da927cc105c3c16aa6ec0a4fb42cc8b16fc7173af8b6f2b1b287b44f212e11b3071fc0f56bd88597822bd311be5dbcd153ebc629c5dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD527867418515a7048aa0232cff47248f6
SHA1fec2634264a009fa8eebcf0b277ff3a323186995
SHA256718a897877cb3241d670787c2a69cdeab157ce9d98bed9b619cf795d174d866e
SHA5122b1b78f0f21ae53948677e45f1a591e7689c8e48fd739f0dcf570837cd8012e7be24c51883dae27c437ce5ced0da83ff935d1fad3e2808da3b795ccf9761b788
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e681454201c87926f27ca4a69a2fd097
SHA1626cd9ec3e5c305f358c8c360d4ad4ff31866ad3
SHA256a7035f9864cc3bd2ab63f8de0419f975b7472f4e838da360496df8d922fe3e9c
SHA5128592e4095fa6d7af7aab9dcd5b53b64fce1cbf0ce3da70d7d02d81c213c54c14a979d7527d6d473753039bc8ebcec912113c0d29ebb1f0081397f29b34a3a58f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD57e50a6550894ce957fb82ad432f72ef0
SHA10a3e6260fccda07921b022eb53b3638640828fb2
SHA25663573a84565f540d094a30377347834565331110f34f13bacc9518fca9d50fa6
SHA512b9b92121a59f6e000d1fd70d16b24f93d1742bd4cc6f6aa10362f99ecfc17a8dc4c3c5a639848f8ad06de20e2a54ae3696f50540b505af1a221e3672ce7e3380
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD57d12125570acbc6414507f36c26946f9
SHA1955b779faa47e4dc704839ec71b5861d27e697e2
SHA25660a68de786d747f1ffd62d3e548b8b53dc351cc1eac17ca896272ea29ce47dba
SHA512e7ce8b231d6b269a1ebb7043c741019fb4b8355a95342e6986ef73bc4dede3ee830d9f8ebbdf31b7d94fd3b28175d7bd0666a42a3453c42bae1e006ec3470d47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5db7895411b8067db42be87718aa3d621
SHA11cd4889664b83eca304c92d50492e5a52f0d18d1
SHA2568e8ed21145d581edb9cfc11e27dccd71397b6a79336e3bc0085d9ed9a4e51fd5
SHA512462166915bb0ff6067a900454e39bc39217daaf5fc55c1dfa4c545b60410bd8fc3ed1b4dfd0bcc86f7931be74a42adbb3ae93b43a0c5ef74dbde51fd70806551
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59f2aef67da575571367d4511b883e0ca
SHA12e0116c6bda00ec12e204a3b569ff66e2dee5e47
SHA256338cbc242df8a69eb77be8f6115fda0f0198374081582562284d762fc4be35d1
SHA5125f22e533f78561f2c0edb72500ac690f15a2fc12f70d86adf068bb2b9a769d7547dc535642054332584f9279093a75e416e005598e8332f0e6111cb4a21415ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5be059e54632e2a632306c43f9130a5b3
SHA17dacb11b5b947cc49f4980d7dec920fd924919ab
SHA25680dda4083d7b35099aafe11e76c7798a835023fed9a874d925469c36c0fd26f7
SHA512c21feeee69e7ff3639fa3e1fd3789f0ad7c0e165103a1296eb3beb5ddb3d7c8f70c64210114ad78e678109fb5a2b0cee2583a69c7d346b526ae6c6ba5bb13ec6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f49ecd450ba275ee7050b0a39e7edd0b
SHA1a3f9d7c8a3a767c6a90ecd3d41b689178ad0a72b
SHA25682b6d3e2a618ad83f35cadd8f7be03d2148f742cf4912af3ed185e431fa45e6a
SHA51264ded471e27724af2f7da66f624d9dd08298ca947c320943bd3f484846e08394053591a02edaa989e30197be03f73bfb08913932e16655495b73cedbce76c54b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50cbef20ba6755beb815e7a63d51f3278
SHA1a37a43f080a14e3b2c929957f5ead8e397553a4b
SHA2560cb9bdfd200024f0fb9044830b55c739d24f50cc1519eba569ccc1c6d5709324
SHA512bb7b324eec653e73ce939a3be262cd8519dfec45cc601ab2da35119da08065fa70bc580d78b1d382447471806afc1c7b76721fed40d140c691d861fa57a24b6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54aaf6a98a67d2d4bd30996a39048087d
SHA1e5ac7855d5ad7ec8ba3c69b4a850080ef653793b
SHA2562ed4f361c159a5db0b9f953a0a30778f5f0f5b68bedcd7d3f892d43b6a43e6ec
SHA512ea5c1e32a4116bfdf8831cd36dadd0a59c66f6754b7206626e20e0af554f0cfce94dee0ea4e22f2e9c95b80a384bceb1b84cb374976aaab7bcbf1858191b393d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD55af5a0b2cd1eeab72847171f4e9b9a41
SHA17439172b0910a80a04d7367cfe4f282431e1de42
SHA25616d1d4d1e229f879c5c14ded221a7a05064438fc18861f8cff8e237b1f8d19d3
SHA512fc7031807a3112d544220066560132e7d4727bb60d8fb0f0b389de4b1ed8adbfe5d67cf8271cb348dcd363cea0e489b9e9b006efea4bc02901eed1699c8e44f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD515468b69d2ac21fed451310ca72222c5
SHA1b8b3039b169807d39a29791766131d913265b774
SHA2560c2c761517434550c10b0ed3b265a0cb082a0aeb6e5eb1bc80e1b822f5e18e4f
SHA5127ca2706d9d900d809ea1688f46c75c50e3b810d1df2612ad2a28850c5e98c5833f2fadf04b73970ebe899da9e8c0b71d3d023ac7d81f2bf00604944363fa29e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD52da6bfd50a234b190db0330ccdfb8337
SHA1996768fe59b2e3ea404dba611e9acfebcd4818d8
SHA2561054abc807b46d4373f66562dcdbf94e577c65f9d1998357266a1800df9f0013
SHA5122a81efc924ddc4bbe4a941d54a7afc3d47e604b90bc2a61fd0c08d78d7abdfb29f8ab75948eef3b44872ca4a74355c88452500dd72c282fe2105308f147f1ca0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD58086676dbc319e8f96504fd20e1216b7
SHA140d781522acf7adcb51cbc44b479acf8b0f3ff85
SHA2566fb1b7c7bdd9adb587a080a9223578009a84343bdc4465ef28596bad8d4b306c
SHA512fc2020b321e73ac4ccbe716959754056666c37f2a8fa81101abc3abd586836c7665993eaa6f40eb64a8e9283699449c5cf4a8ffe468debc47c2795e9d980c17e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD55f7dc5d329fdb5e461686c15ea7fcacd
SHA18f374a7d77c212d7e519f3daa78545366eee7197
SHA256532019c6724aaffc4a4e7d3190f5e1bed5d6770c4c8b13855130a8fba15896b6
SHA512c83c22fee67f04b1264d62039ebb9b72acad0e7cd0b4248f37a56887c0c6346d8d5ba2db18179e2543ed81c638de03ac3111cd18824d77fee9182fd84e79c774
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD55790b13d60aa2bbc51e0c93e3e25881e
SHA157525c7b5ee132cf69d299fa6ef8fd0a3938f759
SHA256bb28bba534c2e230a1a02a7631ebbd8a5c4e03c4cdf08cffa1c916db1a3df39f
SHA5122976f1b5660133afd31d7fee3416d6f9b9f273883c035c32b78a3ef2f7a4f38a60781f73ce13093b836cbd86c617204bc218664d9724b1df21d28f60710c3926
-
C:\Users\Admin\AppData\Local\Temp\Cab1557.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar1A6E.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a