Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 06:34
Static task
static1
Behavioral task
behavioral1
Sample
665417918cdb95682df5c0e84a8b0aa6_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
665417918cdb95682df5c0e84a8b0aa6_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
665417918cdb95682df5c0e84a8b0aa6_JaffaCakes118.html
-
Size
461KB
-
MD5
665417918cdb95682df5c0e84a8b0aa6
-
SHA1
da90c7f221d3d591ab3c682a556f2bfd81fe3ea6
-
SHA256
15e694d9114ad48370a72bd64872ab101c17ea476eb1b79086846806b88811af
-
SHA512
6f494d27d6b7f8ce0acfa38a534bc3addc884b531d8c0bb55b098df6e86b45cf1402184725bc153d3023afe5e72f62faceb1a55b3c6eed7ef090742dba429a1a
-
SSDEEP
6144:SVsMYod+X3oI+YXsMYod+X3oI+YisMYod+X3oI+YLsMYod+X3oI+YQ:W5d+X3h5d+X3W5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422521541" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a0128445bfd0ba4fa03d86032add62d7000000000200000000001066000000010000200000000f657e33a2aab2e287c624efdddf197f816dab38d465f7683bcdf8c29ff9b45c000000000e8000000002000020000000ac4aec684c46a9c522113222b442d2786929eeac629186712d851f0f397f566020000000d5316699b7245d93cec3d13720bb937830e76fe5ed2397b10f25609cab3007e640000000dda2bc9177a1eaa61b91ffcb979474c2884adcf01fd528f0000babeebc6c22ee63e8b5ad3d64dc3c84bf01aa736ba3e35332f1509ea41dd6bbdcf32bb0bd35fc iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0985e3212acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59D2D091-1805-11EF-9034-729E5AF85804} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a0128445bfd0ba4fa03d86032add62d7000000000200000000001066000000010000200000006d90f7031c6540179548710c2026b9bea22c323f0cd556f3dffb92ee5697de52000000000e8000000002000020000000c5a95bb5faed5e60c0e640862d97b2bfc28d26412a1acbfb7b1892ece028e98390000000953a8b2e1edc0ee9a829205122dca5114499222375597535ec12b1e746fa4c2093a74a3817da3383648f2fc7d1a2892226fe890ab6b3102433de13aa868ffc9204b60b73059ccc4d62b5f5c0903d11c776a5b8b23f4b876b4824e077834f461cb4d0ac73f7f2a3fd2f0dd97e85f0ffd8c4bda3e11dbc3fb7e258c87835385a4cf02b0345d91fa4a0814709ef0fd8e67f400000007f485d281c7ee08ba5748d7a28d760502b3092d5ae2221b7562ec19e3f59117db7739dbfcb1d4531a3c7fdce557f533e2ca6963cf53043e4e0b26090bc4940ed iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 912 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 912 iexplore.exe 912 iexplore.exe 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 912 wrote to memory of 3040 912 iexplore.exe 28 PID 912 wrote to memory of 3040 912 iexplore.exe 28 PID 912 wrote to memory of 3040 912 iexplore.exe 28 PID 912 wrote to memory of 3040 912 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\665417918cdb95682df5c0e84a8b0aa6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:912 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3040
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548ceb0e5adecaa67d76cfdb29b672e9c
SHA155b4a0510bc2e87896978ee609a936a68760c1e3
SHA256099b5fa3f416179af2075ed20873459a6af48ed31518a0d9d1c57c4be599211b
SHA512e7321dbf7bf09a57b2b3b4da71be7260c869ca998846d50cf4bad3a99b442691dd5d959eb75bf32702de9b8b5b4144f6ac1fea5c3aa338301f2ad51e1880b28c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5736942e1318d4df84f061e15be1ce122
SHA11b07922e5f4d51fbb6c7ffd0e5bc54e34bd7b9f5
SHA2569aa53398ffe82dd4d665a27745c1926d2e8bdfe9b0b097eb9b44e9adf423336c
SHA512386c4d5c5334939d19a66a2c30ad4dfc47660e90836d87c13efdfcac0d9075fa47ca6826cb90848968fd31b3ab28278946564e5f8ec7e10249c7b8fa2fd60598
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56692db639d5f61fcfe5e52f5bd10ec40
SHA1477ff0b7e3bde35185e8291a2f808d508e40c5c1
SHA2563c2843efa8dfee657c4c3faa0103336d62394fb705e292a76b7351046a9dec80
SHA51244b295c27264e61aaaa4e9d51544e1d32160d49a4498983f1a1a61017e5dc15c47bb42d744f679f363e9b8385a8ff4b8a681c96b3fbb5c046c6a5800ef4915d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5aa63a8c50d807258b0661164adabd8
SHA1568e92334462d296e3f60bb39f38a02e2ff50d99
SHA256b961b2dc5c2de0cc579457dd7961b5a379d12dd45042bcdc1ef6ea781a5909b1
SHA512af4193aaabbafbaf0e2b64c4a9607225671c9454c6cca6162adb7148130b33ad9688630f5d02c06f0f6366521d116ee53fd7a63166dbc81d8caa339bcf3ec015
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56404fd8a08a5ce5fa893d8d7e29e7a66
SHA105bc3bf7f75766ee1d96065824529477070b8b66
SHA25609202760b51d4578fedce0f47c0741dd204e3c8784fb8123acf11c2ba4aea769
SHA512a7169984fb85a1e45634be05e8126744b4e6a6b9bbd16ed9caea2649e95e96bdf14a76237db8812f4645e6cf06e380f443d8fda477bee18e465b379a0213bff3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b36b810fc0bac0f14622cd1bfb4a1b9d
SHA1687b1d60d6e4296a18da722223d01982fcb5e05b
SHA25602fadeb551fee31c01c1ad53556a0572d402eda54919c456898098f2e9230dfc
SHA5123fbb847f98200d42c5decb44d896d8e4f07581dedd97fc2ce304816cd12553959f697439047bb844c2c6a9d7317a94757d126cebe0aca130a16f0d465cbd5c67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7f2c3034677662699e5800fd62e0f12
SHA1d000c94c026d4634dc4ca640b1dde8d58e99bc33
SHA256656e4ba785a488ad02898a132d72a43e88b53e83be3de34a6c3b46b9bdbcf8a7
SHA5123533c6405bf47d099b5ec8a924f600709a8914ecdfb14606f6d94be7eaceeb5d5deb9809e69da6c14b52155e7028542fb57b2e47c3b51d8eb118cc92ef0c0358
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba9e271188b9ad3df70dd088662268e8
SHA170713c944fff8cf58dc52a5ab911c8d412b6391a
SHA256f297e151b3b92239678b22e41373c096580690a37441cca41a1dfe680c505a03
SHA51231a905ac1e4219cda595fbdc8547eaadd2184b4b5e6d2dcc37c140bc7e816f87af07854b715be9081b086ed5871a4be4a97d3980703b97a5f853cd3cb2d75cb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5337a0c3376b0fe744e672a92ea445f69
SHA1ecfd33c44b06502e754c47d508ae136418a70a4b
SHA256f38e693c16b0aba161aa59a0b3f769ce9c626ccc7cc31b94f53f18cbcb4fbbf4
SHA512898e6addabc7fb880afbdf2c9b1c4f58e6cad3bf4eb7f4bdf62da0ebdf95d6c1a41129c3c82a4052e0797d4482234aca321adc9f07d6b0809e757d0d1618f9c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db0274b36c9d764e58e423bbd5ff58eb
SHA18d1a93495e3c17fbe639d682fec0d867aaf7b488
SHA25690f309245f4d0d08a34e6605781459ffabcb47bb1c194e4aa318e0f11a3d39c0
SHA5121802d8778777f73248b2e147e6541dc4ffb5377148eb6266b5b9609a10e91475ea0c7d0872af475bace66212fe9ee7ca0fbbda01add7d25ef5c0ff44152d5909
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501fcaa99738aee5a21a69e28d549feff
SHA195ed898705cab1a836d9c7fadc00cd1871472702
SHA256ed43b4295af527ab9b682132cf6b3fb3c9e0738376d519d7f5a29ba9ecc059c8
SHA5127fcc806e6380f6b11d79893d26ff0be848101cfc9954a03b3b56f6ec698d2b20aae61c247e9c669c961563fa28f8f5c0ffb74655a2f0335d1b033fed1e068166
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570a56e2d087a3d85bc1ee2fab648257b
SHA16ff306084746384580c1e5540da89d365bd74601
SHA2560801154088f562021fac884280c58cf04eebf707a261c0795f79de2c25100042
SHA512b3977efecd6eb0c01730845fc7ecb4ef444341efccdfdde79d30e0a462d09bdbb7d844d204a630f6a0724b7f8e421f773db5790b68adb996dc9e10b5169f79ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f0d733aea4232647b969e13ab68c40a
SHA1129eb2bc368d5724b33c5e813835929b45308f8a
SHA2560a43969845bd2e9b401620f825b6a98e4b233ad83da44110dcdfde9e8528660e
SHA51251be3b4dcc122282593e941da757723cb576a12bda8a3fc5af75e0c179aed352ee6230ab7baa9051650830b9b9ccbce0e65ab31a0a45edb6d4838d28f8c24bb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5087fe0fd8c8515c540be67c66dbfe716
SHA128469abcf71a24d43d49af8fdcebdf0c8e3b7978
SHA2565a1e0bd1210fed65ab7a09c78f46523434f0c4614662a613416153d99e2c7e14
SHA512f76acc1fc5761049dafccad873e87b040299f81baed03fbe047489c30c74ba76a1624ca2f553d9eaae14fc8c11defa00e24d93e749dc1f5a618fdd73fd4bf6c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5083ebce9f229068175800f1f970139e5
SHA10d77065584bdd602a0bfe3035983fe8fec88a3f6
SHA256f537a3f65cc09096fbb462863bcca246dd6f33c22f77068b41b0677d57220648
SHA5125ff2207bd56378785c42b6da307c096b6478a8c95647aeb92426f3ba9ebb85a50aae96de98581eadcb1daa9d66711b8c05235aa5f3d8040fe55779b1aa257ec1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57935b3e01d60c74f9d9554b6d034236e
SHA1bc145c5395a62c58e3a677293989399933c4ff03
SHA2563c1c94d91cff35897f86312830962a9fc5415034b0a4893ada05917179135e6e
SHA512c276cc71d8a3824d949219e6e967c27e6c9b5232f2198011e457b83169a58f8cc935293806bf0e6016ac1e0a84a58a26b937011a81664b2f0bef0376cb442041
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599a9a247c748babb295d2667b4c71390
SHA1007bcf43e5494e9d1c9ef98b26f0586ef226ca62
SHA2563fc7ec6ee856d0d96996e4a9183f682e9443882fd78ba35817c60c609176e927
SHA51247dd84770ba163ad1a6f2f9c2a66504c95ca5fcf30a07c84452c5632a1c2856294fa3ad5c3608fc967796281a3978c5823c7068be2256565943260869c58088b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa90446144b28927858056948f7fed53
SHA170e53ac22df340932362cb7068b0044502130d01
SHA256d997da12b5196785ba629068d14998f23ef39108a6f2e667f440fda4eea3b6cb
SHA512ace341554523354a1feb925f2f3175d0376ed664011bc425654f9d8bfa52b9256886444cae8f655ee61b7fd96f60277b3984de1e915baa3017596a0fa4fcdf1a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a