Analysis
-
max time kernel
143s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 23:28
Static task
static1
Behavioral task
behavioral1
Sample
68ffb54d42091207ceb873be65da8a0e_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
68ffb54d42091207ceb873be65da8a0e_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
68ffb54d42091207ceb873be65da8a0e_JaffaCakes118.html
-
Size
218KB
-
MD5
68ffb54d42091207ceb873be65da8a0e
-
SHA1
37e776d9ea29e527a452a9f1041d46a862f45344
-
SHA256
5de8df2f5e7a787a76ec7ab0b6fe6ea1ca53ed2e9c854a3227513bfc6c61f64b
-
SHA512
629e86cdefca9a83123f59b9a492b87c5117604be7c03b401b85df022d21015670e248164a20ec1fe3401066aa5d2727ae51063b5386470fa0bb4b254a071ab2
-
SSDEEP
3072:Sj+WK0xDXPLcXyfkMY+BES09JXAnyrZalI+YQ:Sj+WKYDXIisMYod+X3oI+YQ
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6024720da0acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb15151d804fa3468a39301f34f48663000000000200000000001066000000010000200000001226b38409e58dd7860eba76a8bb1ee74d445d43b5b9df3057b611676250a512000000000e8000000002000020000000ba8d43109ed008672dbd97a16b279b080dfa94e0092432b4310f6c4c11bd9a3420000000143d5ebd0170cad67df1ce1001850f22b2c340948abb25417a769e67ab1235554000000060b84613f2c22a176ee60e5f998e240d5cb706bd23f523425c67c4995f363b29e857bbfc1e6bd5e4a6a5e8097b7760caa2bd392b49d9656d54fe326fdf9bb758 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb15151d804fa3468a39301f34f4866300000000020000000000106600000001000020000000c4698da9ad92498bf648dcae2bcc5fdf1c43522be6a92e83bb01d8f8156bb3ab000000000e800000000200002000000028b0636291106f625e4d47cc8b33cc910156512124158523f293346342e5e2c790000000f49ad0cce7d41cc3e82ef2f246cb8d57246418805fcb3057c8a0260fdf19a4512b4dc8a71c252145eea9e2a6fc453614850bbdc4260575caed6d684938c90a961fe4042bac14f2e026a0eabff3c6e0501ad0271140f37fc291956dd3148502b66e3e20f6cf07f972a871783aaabdd3dd90fee8fceac49d41d3fef54af2fb26e7dfd4edaf930f36b81b8cd04f7701932e4000000017ae97ff2679ffa9d04d134187e563849e118db0436b10855b93270f227b26b3a49de54b6c4d28203237a1beb2ede6b9075d37a9e244ece9ece8f7dea470a621 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F5F8FC51-1892-11EF-9F07-6E6327E9C5D7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422582362" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2012 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2012 iexplore.exe 2012 iexplore.exe 3032 IEXPLORE.EXE 3032 IEXPLORE.EXE 3032 IEXPLORE.EXE 3032 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2012 wrote to memory of 3032 2012 iexplore.exe IEXPLORE.EXE PID 2012 wrote to memory of 3032 2012 iexplore.exe IEXPLORE.EXE PID 2012 wrote to memory of 3032 2012 iexplore.exe IEXPLORE.EXE PID 2012 wrote to memory of 3032 2012 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68ffb54d42091207ceb873be65da8a0e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560b9fcf43ecbecd7ea9db1454f2f5531
SHA15100b46f25de286d0b28f32d1dca666032616728
SHA256a724a836789cb4a41bd6c87e85317e418d9092aa3cb753b21bbd28bf3c03f08d
SHA512f0fbf7732148b47c96556f7a2bd7f6323a4a8112b7156beb615332b2d6055d7f6c32df9f60d1666487af6447c168db920f85eef6c5d271336da77320fad232a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59270d7484e69b41cba0587a7fa693ffc
SHA1969288c35dce22f156f5464bb75d46761762fc30
SHA256ec15ba8ca488feea22b40617cc5c3474b160620ba2c5199b396680c99157249f
SHA5126b6e5fb92bd97823a274e406811f00a67587292a885560b320c850d3af9343d6e6b95f11a443b4c6e567081e7f9909228b84a0657c70e886510dfaa41d5365fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e75490f0cd5ee7d1b87d0fc5b9dea00a
SHA1f24c72bf3efe5313fc947d4323c82566b13491dd
SHA256b1de9ff254f2ce16bce71298847c7b5dd66f979175e5b065c9712c8757f6aa17
SHA5122430d382bb4e07f836098cc6c28a70aa8d0cce915ea0f1fe63987390e1eb65c21617dd6a815c6fc8aeb887781880ab25aeb293a61b10c7293c74c3906c00d823
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d121c7c1ac494bfbc9812d6cc723e0f9
SHA149812cef64d703e1f103a46c53c7b0c55c1e4e90
SHA2562362df1053e34d2038950c9176617a739a08e5e6c08ba8d75ff4dcaec8daf4c9
SHA51292627cb15fba6aabb242457ed113c2004eaedd62a0bae41369fadde2702f119f27bdb73482382e413275f3d1cee69e911edd0a120d9c6df807b8fc55e6fc70c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff52aaee65f5dfbca72d5c646d21cb36
SHA147a69233a03765298d140ddeb49a34a2add2d7d9
SHA2562934a85e8b2f0b8fd7fcebecfc51bed43ace2d711d32b4262e2636239e3c8348
SHA51211e8f1f73796942e0f4704ef22dc20c7d02b555be3764b6afa3837b333124c678f0722ee2c528a49db9db44bb33956db767b274bf5b58fcb69f577229afc0e61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5186b798c65f7047edadf640794e75a28
SHA1d9182734abe58e036c12b9cbfdd5be2ebcfdd3b9
SHA256eb932b8375e5da786a5f5ea6577959e02b7268db3eb932b1b8e3524fa90abc8f
SHA5124e1baaf17e686ac13c867a072d136278b158fb3aa2fbe0303fccd5cfa8215e9c2d6798bc46dca7a29a0c0fa42b993661bedab82e597a398ea387d8f94193f879
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5462248bff3a788c5df657ad7e8893e00
SHA19b09c2778651c7c00b299e667aad0acbf6f127ae
SHA256062b65ec763c2559a7a6a3a73e7f69862e7d848c21a3bcd071c84dd7f28efd09
SHA512a9197f86272d7bb90332353bb35159da74c98c80e78cdec7e964aa93a0898792c7ae92c396612c2a177173cca2456111a5668e1f49008fffe2ffa0d1899e5f36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc9b39e3d6ce163e2c20e6e2d1923d6c
SHA1dcac6e6cf4f7f5fab9acebeb3ef336b9b20106aa
SHA25697b998066300dfb5c489aad7fd4980f7b36f7be6e39aec9a0d899973955abb71
SHA512dddf53af1de50ba944a519ebd933c7d23a8c96e7d2a799475245baa34326243c7bfe2aab8dfb143d81130d2dc597d02b3135f1ffdd4748e654d6d11f29e260be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52040dcf623b5c9c170bf2e4b4d75dbed
SHA1550103b6a0d850343cf7a8d8bb37a31873794173
SHA256d29b2015cdca07e99b2d0807cfbf176749b773b0a7c20646538db06f31bc8c47
SHA5122d7fc53af2d4f395570cc3afdfc95d7787abda2b5628dec77e62e7a6d1f92c17bf856145e83d0ebf2be9f7b0e14f5aef87604ec739d64c02f1e7324f96da46aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5560f2473ec16fb2c7974a125c10f16e1
SHA1c5a68776b043decd4d7ae37413336f6848924df7
SHA256364832e0ec784f1ee4659c4d93619310feabd8fecf5c7de722d05a7c5a723b6e
SHA5128aed4a92b31c52a56efe7327d6a06d75b3c511681d6fc73b5c7d804bb1fafa96b6836ac0940cdc8195f3afdc72b8320e22b9373c1f96c61cc4bf11e6a5b38308
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55dd3177ca1005955579ddc3bf7e7832c
SHA1bdc0cfdbf09a4bd21190d864558bbe89b3a9f6ba
SHA256b30165edf5b6f58189f980655227dff6deb8370b83b08421271e354c2753f7aa
SHA51279f66efe2348a05c7d13613b62ee71ea7c8d50db375504dcb053948643ab408f621101edbe61f602fcca80baa887b73442b05c889abe5e938d5419ff82e2cd7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ed293c80018b2c790687ecde3950598
SHA1083282ada30362163126105629e325d07c18efa4
SHA25655e0eb73a28e173bebb37ceb6fe1249f8e483d8b782d7222f3100360da6a77d3
SHA512e7e11a56ce130f5c2f8fb966733bd6bf8d4367534e112c0567b919eb85f9e5674a484d1e1f19241a115c00a196e592c8d3e12622949dbd9376b4780f4461dce5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581ed9708defaa4b2f92e76a09940c7bf
SHA1e0da158853d40777405cc78a63b1a372aa462c74
SHA256ec6e95139797782d1cfcd60855c2a230e3e3e9dd994d95506eba3662b6695000
SHA512d93407a34219e1eba3820f1340d8aeb5f96151045eae97b37810d2e3285428ece60ab87a1fb7842918259c07767d7b6092b085a5c56a63d8a41b0d1563e50558
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52137ada4e965de9f7315ab28a70a1e5e
SHA10e0fef849e16eca41e3f897348cd84d021282e2b
SHA25674f4d0bd5faa5c9e0db337f35388caaa4702eb65a5c614d4a76210e820f215c3
SHA5121f5a94b4cc0886fbf963c05cf0a05f0f6bf5c811b485a0267f5546ca89fb13625fff685356cc055a41e70919a4d819047cdf8b81455fb0b507086f60931454a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa2de129618502fe3f0b8b2804ffc1ec
SHA18c150f842fd252a6924d098e0517085b1a023e69
SHA256900c3bbc709564b92fb68e341b02ebf09686e075ddb7a6969603b89bafca6c99
SHA512083135877c120be0f89894d5a6d0593dde6106e202c9a8cb2fa88c01f4331e2ff1047c182ace67d6731ede314799bc1e1d89387f9c5bff6ff13c7f7c7248fc4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550bb981402d94ea6e9cd1e240110b585
SHA115b605a65358c081ba129ba624e34a9a8975041d
SHA256913928fa5dd95b205e9f988a9df8f401f216346381629a03b9af62205a3cd8fe
SHA5128f5d82e25554f8990ff54b36fee8d0b78f3e2aaafdd9c422f56cb87913ac4fe9243ba037d42297baecddbfc7b43dcbf51a3fbfccf8894e89b60cf3692df6f826
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a