Analysis
-
max time kernel
136s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 22:45
Static task
static1
Behavioral task
behavioral1
Sample
68e312dc9ab15192bd14dec3ed6b30ff_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
68e312dc9ab15192bd14dec3ed6b30ff_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
68e312dc9ab15192bd14dec3ed6b30ff_JaffaCakes118.html
-
Size
139KB
-
MD5
68e312dc9ab15192bd14dec3ed6b30ff
-
SHA1
f61c15bcabda8be111db6e715e223f9d5ed58516
-
SHA256
33b6a891f0b82d96cca6d992c049f547ad16922ea8dbbf7875f31d7551aa0ffe
-
SHA512
575145a214212a1897ae692ac64d5d69a7570e5769e3d9b88288c8d6a51c5fc842abc8387f4350d7f5766b8c4816c6f7f5b469b8a53a596cc90a733cd30cbc74
-
SSDEEP
1536:SaJ9VedBlXyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:SaJ4byfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A3F9081-188D-11EF-BB1B-4658C477BD5D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000002729db810bdc72cc1a9557a66816069b0f5705c7cecbeb2520eb105736789ca0000000000e8000000002000020000000fba9eabfad25dda29c58ab5fb03dbae889db326c428a2d7014250aee0f85575d20000000328f35517e97950634d9a534a1e27b5c494c612203bee763a291c46b2c88cfbe400000009584ca3eeafa3f59ee1f2543a7b2265784307c7022a16ef9a619738782a1336366caaad30cd096d0395ac23e2e6b58401022e7c99900ef3892cb3809a31f7619 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000ee041bf9ade906b39ed1acd2488aee1b3ec17f285dd892f0ee880d06c4f3f966000000000e8000000002000020000000a4ee917843274c2a45f796fd582a1068154a1d7c1f4dc876d0079a8d850621a590000000bb74d686bd3569c60109d5408e8ad29e1a066014473349c9eea37d8b82b2f338d32ab87f68afec0d952484e0d777f45c3df00dc02e4e0cce7a086e5bccb9e56ed149c3bf7d9ec47dd9846ff3a500fc9e05133c0066ac11958e66ce12f16ed8aaca3aa80706dbedcc4073aec3139a2d57c8f771e210a4836e821aa1236025480607646376b9cfddb7b2a16be0d83c894b400000007f5e2f9b24751cf42a5596a412979d6250a5954516a00ff5ebad748c326262aa3b58c8763164b27d6e32c2e7d2b5853a46b1369ef6340b34a1ce38f1ca666194 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f04fca1d9aacda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422579818" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1868 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1868 iexplore.exe 1868 iexplore.exe 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1868 wrote to memory of 2704 1868 iexplore.exe IEXPLORE.EXE PID 1868 wrote to memory of 2704 1868 iexplore.exe IEXPLORE.EXE PID 1868 wrote to memory of 2704 1868 iexplore.exe IEXPLORE.EXE PID 1868 wrote to memory of 2704 1868 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68e312dc9ab15192bd14dec3ed6b30ff_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1868 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab14bb8db15a17f027a323cea9b1191f
SHA12f0b26e296a4fb081cb8b575d6d98eb8d99af566
SHA2563312a99be19f4f4965e7860b251bd928be12e5778a1b7c342112232899ec249f
SHA51264d6d74e1670291413d05031e265e6aa1713eea70689c168a46f424cbce4ccbd81d293db566f7ffa7c40ba1412dd37bcf61272bb883d92460fef8f87751db332
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a84ee8ee76141da12dd6f5bc029e721d
SHA1364fcf304fe42549b0251fa486da5f2fcef52302
SHA2567bfcc4bfdd00c933707cd0a872df7a1f9c5c9525f43c1472e2160e7681ce0438
SHA512c3453950be488df5cddeb8807173c26940be1b23fc07d87f4c4cb68c809dd3ce3908afee19590d0ff0f97c97bb91abd96c4a7ae0fadf81e573dfc0df1d6cec6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2481f0e322e401b2b248f00c32fcb26
SHA17bbcb9f65431a32914252ab410c8003035fa5f97
SHA2566afa9fcdfc7e36ea92123fb6ed90629290f0e2038ea4bf02dec5f02f1a18c7df
SHA512695179422fb4b8e8b1c012f3b8c531b099d771c0c567301d5ee0766bd074cac6a117edefd2d99aa1848974c7ea83242209cbf0c1c5bc74220e42c32da0af761a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f51d462c5d3b932bcef3b4a7c34fd2cd
SHA1fcadc2802c2e27f0271f1daef0f0d9165fb0c825
SHA25623e63e0fe4e399d840bf9785f1d0d533e2b34967ee50184d76ff6970cea0118a
SHA5125d8077cd4a956212cb04983f824793a199c5ca829186e449e461f03f0092cfecc0611c97387dbc9ac33555875ea7ce7dd88c951441d1e318069719d38d28cc80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6a93dc31faae7fabfdb1a7f55badb73
SHA16de619c4d1aab2d97664d8b1f91921f386659be2
SHA2566718ce0cd993a828445ad510f9b43c06108e39d1f87c865a5f977e4974830ad5
SHA5120b205fb100969fbe1322146e7fbed2a24bdfb18fe5b93f9365cf1abd6a0168c407e9039f25c5772adbabc7c5eb162956a2bcb801fb24a92deb8ca24a27dc91ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dca15550df9da6e4f48df1c7f2bb8acb
SHA1fd431a314d08dd8ae8570c33ebf5ae81a46cffd6
SHA256ad62abe4aedfacb691d5d2fdf11428e6ae5dd26ec45d86c573cebf20191999ec
SHA512a5979cf8c964117af2ca669d0bd7893412278d39e5bfd967b3a08d6338e394a584083ee1f66f5f6198ad579acef7f5b666c0de6d7bc82e0dd0e428fbae111582
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cf3cce244bf1228cfa75ebc72dae14d
SHA17dc2e127f54793223cb74c3205b0da110bf12e39
SHA256b2da316bcdc159c773f7471d1c92909c3901ab609857137d27369e872711e2be
SHA512e918fe3a393e4bde128ba5127849382e6ef72f06e817664c3b036769680675ad4c006e87362f5ead8d4c27ca49cf17285732190522ff2e05c16783d746222554
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b34d8f6c7d558363c84defca32caed8
SHA1197bcc5f668967562696d887f5beb303af0cdaa1
SHA2567eae15ad1cc02fcea3664a35a489c413909b2f44a809285cb6dd08b696019c78
SHA512269a62901ad1773970ae31ec31287195a4cb9c62ccc71ab2e10c10440066ebf11a4e0f7658760a4db29dd6b32236f7fe06110261c611449cd546de3b6d12b754
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5acf3fedc34432a08edc3b35b1a3bcd97
SHA1fc25b78ad096569f69832bae08e1c9f41516a1ce
SHA256a17056c8cb6bf0bf106776573893d8577c8242ac4d100c1f80dab36d96eb2475
SHA512e68eca60faa7404daa6153e40509fb89e6e3284b4a45951206570ac4259913b8dc614527e076e103bfb1cb9326f947429db7e9363ac0e9626a1a7cf02d17b3dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de533de47f1443493aca288f0a5d12f0
SHA11d4e303ab731cde2d496bc8acab46b258c1662a0
SHA25605a3ee0eb541cc1062e429b1db46eae86c2b827600044b746acd66db81cfa0f6
SHA51277ee18d4fd53b31c849ac35e11114aa04d324433fd0e745e0f6826e6019442d69b308d018d1768202e2ed56726eb771f79345bfee73206486423e3e7066e399e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e656f54618ae74786a961b624fae896a
SHA112b662ac8342dba61d572a4dca50169341ee9641
SHA25677b5d4c93a01711457ec081184cec2997360ba102eddb27e7d2e1c8f5c0dfb75
SHA512009f23fac87108fc981c5df7f0cdb7b5334f7b45f32cfdb2ae2cf2bedd3325c002c2a4c0adfc913d1776692828ab63d745b246db0c89cea03c7a35ea2aa014ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a1883d66d5d46cdaa6bd20e700822a0
SHA1e251b34557df38a9ed87bd1e5f5494ab9a47173c
SHA25696c4634548f95b91b76d8824fd8b17a3a6dfc271902c609de934a22f0135267b
SHA512c25e02b72a5085e6d98264a58bd56e8f5a4fd3050a03a02cfdaa07c6faa0faa38568ea4aa9c7888b61c60a0d312ded19725412e2bb5f3d1a8ddc5282c05de44a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b83072403916783d61f55a4e75f85ab2
SHA19169bb3194392a00182053c2998b4f306a30acbf
SHA256f02a1b9ab6b01eb5f15a0b35913498dc0901f32a3d4e82e610791a6ffc58c886
SHA512f40078a7605528573fc26fa68934179c70cbe68fdd942e73e52f197d430f55ae10ee3885549d990a24d23e08f26c2aeb606d3e96ebca5afaf3ab8f3e7e69b975
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b4593a6f6d7493df81c5067e73ee0d5
SHA12131b8686ce85d8931dbdedd98b742d4c229ada7
SHA256fcd31156e172d5b9efa4071927e8be06e11a42c7945909e739b12bb99aaf2eb7
SHA51227d11db7cd5060ef9ce43623e0bf7a118a34ff9f65836592259faeb1e199a4db819762abc61d785aca79c2acb2e8235dc5a3de1d77731eb577ae084fef3b27db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2a30c0cba7b01fb14eda510c02a1942
SHA145b84f139771802148ca981aed09a44b3097b2f8
SHA25661da1d3124ad64bf32b7e8de73541d71da2608d96216d7802b0a97f9c5444124
SHA51279565dc6b7f11aae580b827351c3c2a57815969d96cdd3b7bc99f28501bcc33a7da55c95c8b622d85e7aa4ad005380c0b52bafe5b97d23d329d5ad8045f36430
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ed164915829596062c841df0443b57e
SHA16cb83116c05f5b8b0b74cdfabbcfd87cb52fdf39
SHA25647592d61bea19a2a88289df929ec4850be29d562a5e20f0ee75e00a7b92cf34d
SHA512926af06a863292127dfe3658c1dcb7cb6417404182648f23516514855f5e527cd24fdab03b91ddcff599deb5310a79762a26944aa4c0afbcfdbdcb41178e32ab
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a