Analysis
-
max time kernel
133s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 04:53
Static task
static1
Behavioral task
behavioral1
Sample
66102fc6c80e2017b514e988d7b1192f_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
66102fc6c80e2017b514e988d7b1192f_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
66102fc6c80e2017b514e988d7b1192f_JaffaCakes118.html
-
Size
23KB
-
MD5
66102fc6c80e2017b514e988d7b1192f
-
SHA1
5100e565ebe7fed6e3a002fd785725d1761bb8e4
-
SHA256
d8c09bb0f90d3a694a1ad5294b58f303a784126f38de0b0aaca3d6bd7e6d30a5
-
SHA512
8d9c59fc96662a1931b7bef11d99188328270f5f0a986ab7423918dffd7aaab8e28247a3cec91e1bbf82c7d1a5f26c5f5273314cc5324da532cfdef216bda94b
-
SSDEEP
384:jiEK9XpVBD8cnQ3R9C4Lvudu7dMH3b6D4QAmccfPkycbp57k9xhebuzVc9bp:ji3gcQ3/C4CASuOOPky2k9ebAqbp
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000b1fb4e6250cf9cbb121c6fcdbf9ead5e1bce126a488ec46731a66e773a2de4ca000000000e8000000002000020000000680d7cd120cc1dab9cf110bff5d1f4cda242f5ef658a00492af4952b21b46bd820000000a38fc5a7bf298925413bad8a999130e8d89b6e097d834e78dd0ac42c879e11bc40000000a2295eee45a8a70879c9b72afe66f483fc3d6455588814dee721a4ce3c71e6784eeb9301838487160a432216e44a3914172063385b011bea4267cc234d2f193b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000d13c01b9ece442c54720b38b8290ab9434f23d0d87290008cb11b72489c4277b000000000e800000000200002000000019cd05257fac73fba57081ac894a4fa351cad6544d026ecae478cea70aa5cdb590000000183877ef2b5ea3fee65ca31c1d333820038069f39b32e044aa9db1e3b506eb1bfea5312b2dd4a6e2299b3eee70d799770c4c1c7e31ad128c43838c50fe98b13aeaeef338dea977696d39f72c10726c7fb68acaaa2bd929625820802a26555ef5868f6f0935ff6a2745f47b94c23c0e6018569aaaecb197a5488d898f03ab9a483b36478eb5fd2d8ce063a911dfba4a4540000000ef1401fe571908052bf7e9c7f7ddba008726bd4cf24851d06aaa5c497d55f61535c4255745acaaace258f50d1b996d8d294b4a019716da46bc4fbfe3992233bd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{38707DC1-17F7-11EF-99B2-4A4123AE786E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ef170d04acda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422515471" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1992 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1992 iexplore.exe 1992 iexplore.exe 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2448 1992 iexplore.exe 28 PID 1992 wrote to memory of 2448 1992 iexplore.exe 28 PID 1992 wrote to memory of 2448 1992 iexplore.exe 28 PID 1992 wrote to memory of 2448 1992 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\66102fc6c80e2017b514e988d7b1192f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2448
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bfab1d45dcf2d0e1d5db6d74e293e01
SHA16de2c0852669a586e191b279f5204c98fe39cd14
SHA256fae77a41b164ea7142897384dfcb25da907abb05b36deb451fbc5f0ff6225ae0
SHA512d21d9f361ec6f97dbe75c698bcb5b4888c08a1331231517bda9c4fa028e8082c52fb4a0c64445e40bcb77344bb7d7994f04497e274069dd66266cf4dac45e8e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ae51ef7a2e85fe666144f2473406d67
SHA199e8ceea505ae0d1e58cf1326d4d889aa0484f80
SHA25633a4d308dce605491a8eef0ceec446d9a0af4137c08b7cd843ed1fd44c79b376
SHA51246c092a7970877f02ae0cb4ebf724678fb9a9126f11ecd422aea0c316f7d3852a71cd3cef75eb6b7969050e8b5e32c4675e27e47eaa985c632fed475389a8a87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d77f0c67ba0e736d7a9313a2bb598024
SHA16cf43cc223fcf8533ee968afcb5037e60bc16e17
SHA256f94b53ad990887e405e7256b94e6bc572bcedbcf71443b1224a5bf1630d3aa79
SHA512b58d63d47059f637bd412ed35676de653459b49f35cf8212114caccdbe1eaea27607c9e55f5931740b7fd918237366c479971fe5e681e500080971cf2677d486
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b8d58a137507873cd8e7ded0ff8da11
SHA1efaca680c443cc2c70ae5946ffc6dec5a44cdc83
SHA256b52d127a14fde856f796b09a13fa40e3089d67623b3ff8698709106baecd8b7b
SHA512e70472e7a0109cc872c614fb33da852e3f7f788b05e6896e0a93080cf0bfecab578e2a1d16829d77e2cff4b81be2be20d5cd26ffb6cc144b87577e40a55a8cab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56dcf9b97137d2822c872ad3a6c7c8ba2
SHA153f22e7c786e8044127b6bdc3b731818376b04cc
SHA256464009513a15e7d4384d2a0a483f87182c1757ce108492db0c67978efbb1542e
SHA512a509007e7c069d2ad93acfc7681d5dd989ad3a4860e5ea70eb9a858226181a6ebe91ade790fdadf0ac04f8c796eb9293d43658fa6eee804792bfdcdb8abe993b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5844050244abdf5764191386939cfc6eb
SHA17cbeb7f13a90bc29cf2bd454f693f01d8bd2f89e
SHA2568e7c41e1e21617c5fc007eef8c16b8c4a96c9ad4cc425542e5074a80d8fe0ce9
SHA512b6c5ec82f424aacd76dbbba70de1a515e13540a71f837d502b3e453abef01f5b31fd84a03b29934b12447997c4c7c480e8ae5b38c93eb3499185dd67a5567755
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c26590ca7f6ded087784689f0e09af20
SHA14934a268a018707836fc948af614823b929d86cc
SHA256c17ea04e2209909f22830bb1614b3ec848a837e694cf0b8c37fcc83a01877f51
SHA5128eb736fddca2d50816f6b76a4b6367e1be3fa6bc87747972255c8351a0b28a565d86b6f5506731d8c9e4e7fe6e666882c5b47e3f1939a63a1e8cf7d13018dbf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ad71a157101a13c56eeb52b6187aab0
SHA1c0e1beef36e343eeeab475b552d8b96246bfd6af
SHA256e5c0d1c0960ece3071a3b308404f9ff9de100f4d889b3310535665ce56e7d692
SHA512de6d381618a8bc37b381601fecc1096e2965100a356f3cbfc86bb480a155f7da8e20301d841ffd88b7c111072953dd9a133178dd5b0538cc86c83d3c303e44b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1c62a8fb6bf200a1e506a31f0701cfa
SHA1b947ea4d69bff076c73b95941558604fc00b66e6
SHA2568832e11a45cda039f66c1d4dec3de9e2ac91b89e145417c0bfa21bccc6b4199d
SHA512442373b8145ee5f333124e9f149ae38fdc4ab7264a418124694c41f989d9b56601354ba2db6be8cad7a15d689ae743f1a2d0d7497db426739391ac8e3a5ae50a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ab08a35ee5ed7c59f226463a954dfb4
SHA1a9ffa9ba35709ff00f2fc7330746e9216fdbb4d5
SHA256b342790d871363ee094509eb42f1c2bbbad2d073731f2fd0a840128141a6d646
SHA51260597307d2ed6241bb2a8c1a04121442052494a809074e518a3734ff97c1ae202a0f5c4c081286e1f9bae5f365bd054f9bc04cfc654a7683339fa058f9e500ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53864ffbb269dc673aa42bc078afc6f7b
SHA1cd74dd2fc8080d62aeacf8d93a854cc941523e5e
SHA2566b474c1ab022c1a33ca5bbfc76dc2750cb9782aa35ee4fdf07a3d26607b93161
SHA5126f22de2ed783ff2374aa5160742d1fde6aae74139b6d8beedabb1816e7799c3e143c0eaf01089503c5bce7de6a30d793a29d25510125bcc95dfbf319306c485d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea35ea82b6a6e4fb90264880019369b8
SHA1b9e81c51ec74fc3383d1cde4c1a84e806dcef8d6
SHA256a6587a3e9b9564bdbb36b6b57d12b60b6ff0acc5b10cef9e47ee14364d776145
SHA51282a200f7d2a731069cc83b780206c538435b85b910478162a39823d3ccbfe509d86392e93703bb85ac74b6a98902e936411a4bb1ed9232dfbb5f0a66d4138666
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54321de0076642b9440d94a5b5e2ed00e
SHA10f5a15e418602f3020cb0afa3cff8cda1bac9cf5
SHA256f1b37e7cf205093ef71025981b71cc64159b745ee35a0075bfd575f7c594899f
SHA512149be31cbdb4e3d830658e5fd96c4a31e64649a6ee754258bf61bffea566028351066dca4d585eee47f763b1a551a5b9e5151548bb24d32704b26dbe73285719
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba6efaf39c5d203bb4bbb70c130f7619
SHA1e619b810696efd9dae881c8ae599adc0ff187e56
SHA256b81482d0b111e74c85ec0b17ddbd1a9a63fd35d13c56c3f644fa622f3deb1c20
SHA51286370807e96a1ebb1e7e028bd50f5064d67af612da712a4875c34350004c2ae1a30abd6ad11ad42a6411eef3ed31118c1598872688cdb646b29f73d6b077196e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2341205b346cb4529f4a4985656b83a
SHA1f04945dc0710a1ee821226e9235f33ba0eaadbe7
SHA256e0ac96b591151440662b4f5edbce1887e4770e6a6ebf746d187ba8be720a33da
SHA512f7c526b4c62af809aa1f3bd39765299d036e210a3c8bf90a68da0cd46ae16f8b2e93a9cb5b8403c3675e4b560aadbcd606a8b2a5578c215021aaf40b36499eac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5262ebfb67783673b592da41480d6f7ac
SHA1c0ab006b45d613d55588777ef6f84c50941c547e
SHA2562f7c0a491888280dbbb0e931007715e09a5d309cdc8bfa55b02869ea7ba1f7da
SHA5122090013a9b9c39628eb5dfcdd20592f1dc6e395f36740c6d5e76bbf02103559a9d54166456b447a47f5724dbb2ef1ae16e0bca0ab65e3a60c8da4e67f075f082
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab5b1d1e8be37f8a187cc9145feac9bf
SHA194d5cee463d2b5ee4acebfdca9cb3da7abd658f1
SHA25666911e571f8bcbd7287fd9757be5142a4576f09c5a8bebb8eba1683000619a59
SHA5125f3ca5d90290c92e96778d8acf7ad584913e4cd270cefcef4d3b6ffb49f1872e19d2e1486bdfcd7a206e45cec9d496fd480d2793b86cdcc3ebab068f1011d644
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f667b08dce1a4dd9d5ce511f68933d76
SHA131af2a51875ede297e937cda73cd306b9da628da
SHA256af85d5b155dc57a8a97739a03c5e54b337a5f4b2b4c87521bdc385fddbd95fc5
SHA51290d61dc79fb273d7086da259cfae60249b14307625599feea6657b11fbe658ace235da5ba9e2e086e2d9d9594ab9952ba6a980ce4f296a72e1f57c0efc528eb0
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a