Analysis
-
max time kernel
133s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 03:14
Static task
static1
Behavioral task
behavioral1
Sample
65d185edcf83123115ebbdf954f2b3d7_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
65d185edcf83123115ebbdf954f2b3d7_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
65d185edcf83123115ebbdf954f2b3d7_JaffaCakes118.html
-
Size
213KB
-
MD5
65d185edcf83123115ebbdf954f2b3d7
-
SHA1
7735bcec42c8bb3e4dc8cc19ede1d6e3d7592dc6
-
SHA256
53822f68778ff63122f547d53a6760ba2c28854cfe224c252fbfe8f62a871a81
-
SHA512
36ade891dfb2a0fac84f35109650f1d0ce5e243eb9b660f4d3d7b1bc9ec5d9c6b07f9cb9169a570ddab4e9d1ff2f7afe892e41e1acd31a9a901d1405f4c2a07b
-
SSDEEP
3072:Sggkz47ee8zyfkMY+BES09JXAnyrZalI+YQ:SgmsWsMYod+X3oI+YQ
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{77985EE1-17E9-11EF-84C7-4637C9E50E53} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422509564" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 352 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 352 iexplore.exe 352 iexplore.exe 1776 IEXPLORE.EXE 1776 IEXPLORE.EXE 1776 IEXPLORE.EXE 1776 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 352 wrote to memory of 1776 352 iexplore.exe IEXPLORE.EXE PID 352 wrote to memory of 1776 352 iexplore.exe IEXPLORE.EXE PID 352 wrote to memory of 1776 352 iexplore.exe IEXPLORE.EXE PID 352 wrote to memory of 1776 352 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65d185edcf83123115ebbdf954f2b3d7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:352 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD593e5cf7757d03c6c472950aa8778aa1d
SHA13531b7f950da319143651b23628004ae1865eeff
SHA2569cf990037d42d8bca65ab10488ee2efbc246e173d36be6a01acb4a7a9108ec4f
SHA512428ed8d421848d46f820ed85e719375c781c116699addcf4a9b8d998056c668090126d703b4255ce7e04fa14dfd86b1d99e5a4ca6df2ad9565e6f733ca80925e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5efffe64133b7988e94cd7aef520a1e11
SHA1e40a1f2eeb6afd32841b2f802c933af12b9891e3
SHA2568bf8388bd6fde7f3cda308ca59f4d1e8028a34122df3e47a9f31d2a711e2a4c1
SHA5127e2f09bd66632d982db8f2621be4bc998d48f85240a8d1fe3c1a896c8d5c91841895fe01f474545ca192f3e14335529bad6e1b4aee5c08e0c11c8c55665dc599
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d6a76ab22fd6fdf0930ece6549dbff5f
SHA1d8e7d4f8f5356b63b2d6092a5423d5f53864063f
SHA2568e912bfada3c29ff6743fcb792095ac5766d5cd2ce41a94108ec4d93409cac29
SHA5120cfe0126db9f28d1c7308bfccedbbcd1cb4a464655592366c13dba6d3f7d8326bb9c6250d3d8b354c0b63cd1acd23f7eaaf25347af94ee506e17222e948464e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a7436237664c3d47bd997de39e97d8f1
SHA196679d9e243521785297379ed7b86a0347d1f5ff
SHA2565d199d7f3fb74b65a1d074a36828a1a3228ed87f826da0a2d986e66168628a2c
SHA512d5979805b49edc805eb8aaae1a4d3971e463f4b3c17dc706725196557285d861b95dc2bb9f9a613245d1d4f51d48c3cae34a8d7cad55e0e13073f425f7fdcd24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD52b0e8e743fefdf966940d10d6a5f6be3
SHA1b4a558362082056efa996a2dbf0eda65250d730b
SHA256153284447880a351f78a8472832b2db73b946c66b593edae337ea2f0873e3e2a
SHA51243ec96a525da5acb7b63898abd56267b62ff7914a69c600fae4d2a6f950685320a05ff7d63360409393b28620748b688b194bf3fff1bbaca3e632095bf6ba572
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD58c05c8bc5cd512d22182262cd633c49e
SHA125f25453419b633af1f2ec7750cfdf207fbe15c6
SHA256f1a5dfe44b09987d9aaf039030b647228ee721bb000174b5fc8b791bbb423739
SHA5126da590c7aaa0ed67126aeaa391b3b02fc6f4cd870d33f4bf63d1a59190c7b5aaefc40bfdf447a86ec6f6cc64ca8170f22affe426d00a22a21c01f3087d4d01c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD55c5edbc37decce7951308a9c13896b2d
SHA1dff1987e74be85a8842a4feee98a2ca4ba663144
SHA256f46da58e95cec9aa652c5a4ec430e7e5139e2ae4c8d86578df2a8d9cd978ca94
SHA5125e83e33385129bbad268c424ee6973f2fe4a753b6a326c4975d0cf4c337c0224f69c24971e4b0b7f8d89e4ca1222fb042581b13ba3494f0c48696ecfbfc93e54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5424969cca6b9620f93341f0130ff9bc0
SHA1d74344234734dd6f1bba59ca26efcd08d1a7a41a
SHA2569fcf6af8bb6147280d2eab0b9f914ee1e4ec41577a7a95d4b41a953ce945512d
SHA5127b01c20bf380eb65daf099f4601cd892ac42eb2c039f3bbb14795edd30773cd956bf0865d0159edc36f25da0488b0d0082f49350f495b1cfc41adfed6352ac96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD501cb19318d6569d21851ae0dc13ea903
SHA11942b07bd40ae156997d4711aa5faeaf6fc6dced
SHA2568b0726c27ee6fc96b145e466a96d464af7510fbed674b914673a2eda33ad4fcc
SHA512019edb41c0355ba6e908344f568a60ab56f7737348b69e8949f689599a9797fa3466391f1fbfeb227f3b72ca3d4d7fcec6c1f009448aa592e451b4e2f03e8944
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5de7bf91f37c31b730a488d0edc48388d
SHA1c63425c9cefe66b60b2bedd0537c4f8ba0f05f09
SHA256055b5edda953bbdfef98255d5d8e172ee562b9e03af28ddca955162ab79a88ae
SHA512c7c7741914f32755bed497c44271b9f974af1877858dfb96bc8eff76b8fd9c0803ae7dd5fd744bfd364128aedd43dc3541ee294ca99fc5ee569201303c70bf62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e9319aeda9a15c2439c67b92512bb9a6
SHA17316555135c8ca2238f0cc53054bf1e08538a022
SHA25619f1c2b0c4ae1bae0f036137e687db8e5b58280603c39d75179b501c59f6a15b
SHA51203e5349a72f022fb8ab13fc8c303ba8e14b7b4a052430220132d3f50ab5d70535b9b9e0df8f6cb2f144913be94bfc05d73e12257661cfc77a4e2faa0ba4284c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD588a7b77de67ea99a9760b7ef88280991
SHA1b8eb18c6ac42cf1b677397c9011e4e21a16e8799
SHA256e27238c50d1c30213143a30dfbe742f89ad36cce861f5afd506b66222bf088a8
SHA5125e573c32f38428f75c3198cf8c333da15d2971b80a6e300ebc13e50b0a4dbd9625abfb11182bb9a52edbf4ce46a4d7ae58213d3a8db499b9fbce7fb07e3ea94f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50ed45d51caae45df891afd4a27e52038
SHA186ddead0f3a5aad229b6bf38b733d52f43134820
SHA2566089ad87644d74d2315ec81e8d547fde3764aedd7266baeb7c72e44921e90c6f
SHA512635fe8daf92829d9a68f66dd365a17b46a8015b18155f4d6b0efc5067075f166ffcd227850306c853bdfabc20b899662821a696321828c206fcf546ed47769aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d9febee349e9c2278c59dd3658f20a82
SHA12e2761cc6c94fcf1d9b5551409d33bfc5974db48
SHA256ddd71bd11075afb3c6adbc0458b758c2c3637925f379023d9a914289b0ad9dd6
SHA512d086d0dc860d8f68a9875f5482da4868155aadc9f6bf718a1b04147b69eeca649c6779d677a7c54be77118c27d5b459d5153e2bce9514925476de4c292f99461
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d74ffc380acc1e67482e404eec912268
SHA1950c92f8031d84719728375ba4a600119a91e13f
SHA25658f4636e3b68cc924eba1a8ab08500f767fadbe60740d2b3ab6f83d8b838e4cd
SHA512437a312ce2ab1c9c3109145933ebe4366f3796e42fae7bc833fc3401bfe59f8aed26cd0999f341365e3b8059efd38d72c66679547b324679d846d4a3e93e4ff2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d31ba962329cd48bcee4a7c01aaac360
SHA1d2427474eb01760f73ba800b9d48ea810ec06ffc
SHA256bdfbb86266dd62c93f5623f32180b9160eefb4b787ce1de2355081f9d75fde70
SHA5123fade9640aa3e69808b0de9fe9677eb847fcb2548f483d87886ca12f26414ca3ac22ccf3925eb7036e9de41db93b27a0bce5dd704fae8545eb2347afe5ea9a5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD57c2a6288ac9eb9bf7e3853d1acaaf58f
SHA1288d158635acc7e97c20661f174058ff4c74f12b
SHA2567b39fe0556e842f8babb4a5db2b35a6160d0661b4b8e047cc7aafe14515803d6
SHA51264980fe47e0a61ba8007db4017918d0af79141ddfd94990dfedd258febf9b8e088402bad0c023fbf01d2cde969d9dcd6bf9e9490256e1b75080e252809856645
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e9875f31a03a241e6f60c4e4898a5f52
SHA1393d305f1b5477640d424fd988e99980fd947214
SHA256c68830032527af67d28962c132440080dc77e8b7235558799606c8903289f6e8
SHA5120f946309aaea308dbd3f9898f8d4ff71eb77d6cbba7025a087365e812fc0c13e1fb944743c051a28ea8ba067ca2f62d4a103887a9fbbf424647a247b8642fa31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD572170754cedc8f2c4b93be87675d4c95
SHA14a7ad8db9549e7a1c1935c80ad3e59b09476e0b9
SHA25698bfabd6530b966722f637e2bb422c6fe86d8835b799761e9a4ba2e0287eb173
SHA5121b15b8c6a6ab3dd9f508d1514a0dd3a34188eeb612802c78c74b45de56e912a83fa44683d4959a0606b5142658015d8065dafcee95c80c4fa0f6428510d5c917
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5851fd166b9e9f1d530453f70cee47a72
SHA1bbbb810fc539f35f05fe5c1158df6778b4855e80
SHA25670da4dac5306e1fadc1be854ea39c4d65cd1cddd235999db6d434c69498b70aa
SHA51232b705e24ae9c5d184038b97eff98f7cbd18a6d780d8f0d5c925b75f32eb1787e4d539458a9f3e42a7d0e26bd451b6a50422e002d0747a9262293780de579fda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5609aaf79250651ec11c7e7c4e719d9a1
SHA11d6e9b41c6bd630aa7b676f15b0ea46979dd1464
SHA256fddcfdb65983aa02498b3798ad1de7e3fbf524a48725080b3b11fec74a4db666
SHA512322ced3ad312af7a5c0d0c2de6deee00055fcd269a9031f683698eef443dded7f4379a3dca4c3e494ecf5abf063ae99c53a4a2a472a9e53b16cb6274bd7387c0
-
C:\Users\Admin\AppData\Local\Temp\CabED2.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\TarF32.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a