Analysis
-
max time kernel
137s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 03:21
Static task
static1
Behavioral task
behavioral1
Sample
65d5b383640bee33bcc58085f1b10ed3_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
65d5b383640bee33bcc58085f1b10ed3_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
65d5b383640bee33bcc58085f1b10ed3_JaffaCakes118.html
-
Size
460KB
-
MD5
65d5b383640bee33bcc58085f1b10ed3
-
SHA1
3d62f7b1fc6963d1dd30e394fc35057f87b41300
-
SHA256
d8a66d318fbddbc30240b3db71a4f4a92023800eb3903bd7a52c5e08ee2c884d
-
SHA512
83c9d21ba3cdc4fcdf923c2c4646b1ee1d625336f9c365e068e14aae11aef319242cba2c744860fa92ef52cfc2b5fd6677b907ed062bf09701c65a2e07f6320a
-
SSDEEP
6144:S0sMYod+X3oI+YssMYod+X3oI+YQsMYod+X3oI+YLsMYod+X3oI+YQ:z5d+X385d+X3U5d+X315d+X3+
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008a9d9c977453e249a07a127d9b208967000000000200000000001066000000010000200000002f491012f305861c5613963064a64d57c4e28034aec80652987081b5dcd8628e000000000e800000000200002000000039dac4e2538afaa5e28aa65e2bbe0fcae7ee68e0c92b62fdcbe593bd288e90b1200000009df2a4c645fe1b5d7df5b9f6a565cd66a7a71c4f2f39d994bb83bdb92c769e0d40000000348d2cef8e00fd558320d792e941a0d789b2a29cdb5bb3471a6b98e516f96797e4f5917a6da14fbc5e63ca7dcc92062c39850d6990b3ace9d70281fd8d948a80 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422509972" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6972C4D1-17EA-11EF-8698-5E73522EB9B5} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0ff3942f7abda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008a9d9c977453e249a07a127d9b20896700000000020000000000106600000001000020000000006f66784f756c5466cd42bbace552f5584b3eb0734230d6fcda602d8dd2c93b000000000e80000000020000200000003d5df7971df74f10bff38b7884191a4202043172d3c783e5486ccd4c9643362690000000ffe38157f7e3b501a4ee71064ab6918621cee1e69e1c1b7d2260a1530cc2587e8045fefff6c8172043b072b6d7358412571d216c8ad16498cfea6755f2735619beebce47af18ed83b992abacbfdf2b63c8ebf7bd01f25cec1ee2655260a02c7a1a0eacf9a53aa87dfc6a4574b2d3e24eafa91cfa48944a3d2ca26761b94719d94636d75ce7f414f421b6e0741bbce77440000000e1e30c296b997d1ab294469ab773c388025e76efa67394e6c88d24ec409864c7ee2ac9067cf169ebc7caf8320442654d73660571f2def7b757d173993f561da7 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2804 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2804 iexplore.exe 2804 iexplore.exe 1216 IEXPLORE.EXE 1216 IEXPLORE.EXE 1216 IEXPLORE.EXE 1216 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2804 wrote to memory of 1216 2804 iexplore.exe IEXPLORE.EXE PID 2804 wrote to memory of 1216 2804 iexplore.exe IEXPLORE.EXE PID 2804 wrote to memory of 1216 2804 iexplore.exe IEXPLORE.EXE PID 2804 wrote to memory of 1216 2804 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65d5b383640bee33bcc58085f1b10ed3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD56fa48bd6c73ba73d855cad77da0981bf
SHA1d0374da9f373101b160547d1259e3ce120a231b2
SHA25699a76ebb3f71381732fd21f82f59c7ccc20da4bdb78d4951709f5f475feebf3a
SHA512f02ff52c032dfae957fbf21f78ef53085cf4ba06e72eba03a101d167d6a71913c89a69816b1b90b0f04bca44fd9e0f098d7cc2b8011f6866e5b617deda347b7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD57f44184b03f3816a412657fe7f275e3e
SHA13800a82f2e6f3e06974bcfc149d9a9a566100719
SHA2562f137f7e13b2a3ca2f98cdfddce5fe5ea9ad8884bb8f1bf79dd8fb3442c365db
SHA51223c72af10dd2473829cd8c54926d1e04d1642f7714cc077906a4d191dc91fb67e99475f895e2503faef4df5147088e4b731aae72c4054042644c353cfde6e2f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ad394cebaf1b2957b27a35fa25057948
SHA195ef3142b4cd41aa7dbddd793bcda9bed3abf581
SHA256cb615c27fc3c9e55cf185b94947e255a4f0d07555f9f444411d83c57e92385b7
SHA512ca2b576bd3ec7d978424747d7be5cf1c8e180009ef70f0b55dee7a4b2812d85019835ab0725197d87b0aef18ec0bd7dae1075a5a62e374e589e65adf5a627063
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD57285d28e263725519daf36eb6e63ece9
SHA18251651893ddcb10ed037476cf88cf4dbeebc983
SHA2566607626fc9b134bd93fe6530ac3b239a98ab2b6a74ee3aef5ff888ce89c8920b
SHA512a523d5e28e0697d8adf55491072dcefe8ec83e198010eedb59679d4a6bb52fd196b110888a4b8c19e4e65a07da38dd85b637d14aad6b1848247952c46485b01d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50ef975e53d2cc5347a7abf4230fb7c4b
SHA11e8c878b6e9a51a5e4ebc5a2429b86a7ce50b6aa
SHA2565addce24a0d0f21096b4db9fb9ed365aefe0307b2855a8433913570540faeb06
SHA512454a206f5d5ef0990cff1264c440ef9a90ecc0a2db0007db0930102cea32ccb0accc877b97b9680075c6cc5d5193c4cbbd6501c38835f1c1ac30b51e0c61e789
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD588cf768e5a0e533f50e67b808d66cef6
SHA1ec11b171f0267685d6b462c46a9833e956152668
SHA256250dcba3932fbfa5db86d799517d56f51a4f61cc5798dbdbe6a76094af44f634
SHA512d40ffbc75d739e17f1d46394cbb6d6680d8bd168f6ef4a910678388ed5d6c022d4900a05a1d3b16290badcff7df7eec7989f6fb833bb654ed86de8596708312e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD57eaa3159e3e5993f2ebf6edc3216a281
SHA199f10acf637e51a1882b22265d6b2de4016919e8
SHA25662b0df3048a1ba0210505a7fbaae5875bea89e9b1121886b988fb3d94bbd98cd
SHA5127fc77134c31b4d30a7c2d9139e59085813c89eb7a24177680a90af140b43131cc597febed27127bc42476684411c21f7267285b520f912a648a1e0579f010f87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5064708b8d4d08309e09310aeab5d5362
SHA1e0fab3e4971ce38098f4f9cf1dd000bb03d0fea7
SHA256f37d513894c059305a9940c4c48e243c797d4b04c9d39b97bacdcc3c1cba7b25
SHA512515f45995deab4917846042ecc94211e99f8aab62a446a2baaff24f6bab90402bcadce034f0087ae17969eae37fda02c8d19fe7d875f177ed72729365744ab69
-
C:\Users\Admin\AppData\Local\Temp\CabA5E2.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\CabA6FE.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\TarA751.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a