Analysis
-
max time kernel
133s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 08:28
Static task
static1
Behavioral task
behavioral1
Sample
66a3322d5d187ade1977954f8ae6f6a4_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
66a3322d5d187ade1977954f8ae6f6a4_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
66a3322d5d187ade1977954f8ae6f6a4_JaffaCakes118.html
-
Size
213KB
-
MD5
66a3322d5d187ade1977954f8ae6f6a4
-
SHA1
1e5d25610e07ffbf43a999612014b7aa1a7eff81
-
SHA256
6885d092297f7e9a5b493ae5c43faf6ecb7442dc1d7f16cb40f4a2f10cb3548a
-
SHA512
eb184de62cfeede49109473add87a37f298b46fe3b87ad7ee8ce5fbc05839efa61f7bbe6bb003c69ce5f5e1bf5687b889180accf1240645fa006eec7973e8b95
-
SSDEEP
3072:SqV8+XDGXgzheyfkMY+BES09JXAnyrZalI+YQ:SqvEu7sMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F25E4B1-1815-11EF-B21B-FA9381F5F0AB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422528394" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2460 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2460 iexplore.exe 2460 iexplore.exe 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2216 2460 iexplore.exe 28 PID 2460 wrote to memory of 2216 2460 iexplore.exe 28 PID 2460 wrote to memory of 2216 2460 iexplore.exe 28 PID 2460 wrote to memory of 2216 2460 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\66a3322d5d187ade1977954f8ae6f6a4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536fc352ae1ccba3ac19426d4048f4b77
SHA1b2f7fff6985ef49fc1370dda00f1c1384a164c77
SHA256354ef7bbf40df5ff48705e89c4a2dc13553ccd2dd59da920ee3353c4d9e52e5a
SHA512109273ac66f7ca2f7e360d594925cb0cdd93958e7e6502bcf9e3981264c9324be0c18f173153cae1d1a843644a65fa501d0743395f23f9896b81fe86e8fc8d09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb2d980e8f5255b8ff1ee0cb4d541fcc
SHA1bda9236bc22786fbe8bde4bc097d769369512f5c
SHA25683939939f3344c3b0bd24ea58cc0e380b92e5551b53f0fb957b6593dda3f177c
SHA5129aae53461b07dfc4aa6fc45f07645a0a13bf02237f2b299cdb8ca0442fe68a4eb21da024b0656d9d6e37c7b3023f5a96d792438c5800d6c70c507942725eccfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a3a3601aeb8bcecae40371d84578482
SHA158711dfba9ffa8c4e96182880e009f61d51e94df
SHA256558ccb8766262fe2517fd45f5c220480b7cdebd5277659230b338b918da0d2d0
SHA512ac506883b6a41a973b82241742f5cd0b7f5a7378692f245505dcd78ef14f0f4d3d047952f191fdebbea83a7d3f6e3ba08ed103c7bcd87ee739047cf48e31df1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0b10ec681c98ee277f8fd5fd8fe3c03
SHA1386b31d61745834a1e11ee7c0dcb7f6aa453cabb
SHA25618972103f6fbc0cc066d1dba6a5b8aa76e05a314721e9cd48cf62847fbf2c3d7
SHA51281b7bd982e46b27d7bc6e3febb543956ca010478636c495d7457dc7af478fe0de87acd2a315f651ad61da7f1cb2373553b42b82526ae7c999a9024d69d1a05cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58823a2fa7bc79640c1e9e2dcb123f888
SHA1759b766afcafb5bde922ea290f5f1a380a2cb8c7
SHA25618d1f4edabef128831330ba9a5bd40ca0a29af572edc67e7723acca401967c72
SHA5122f9021c30693bb335ec4adf24cbeabe9d7591623a36f93bc2d1a1b2b44109611cd26bc2f55298fbf69d6a528ff80b26df96f47a2759bd03752a59473bd3f3d24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590a2c96debc1730ce227e5275c8f5fdd
SHA16e7f3b384f6facfdfd482f706949f8a6017f95d7
SHA2566f5e2c6bf67d7e4d576d6b175e5ad8fb2438a61eb1c13a73a3335d27c43dda4a
SHA512c4d7b5c83de4f714d0db3bd29206a0cc7196b7066efc4c325f77b2dcd6dac2bea9e898f4f06d3d78fa795fe3021d523749c72ebbc770846e3eea355a48b19b55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8f3c86f7970ed5f56621c041859d765
SHA102ebb2eaf6448b141cdacc2581fc25d81e438d5f
SHA256130fbbf47451688ed6b686d5f4489a3585d89a8e52cacfb3c144047e90a34e68
SHA51213362caadc8a8d06fc3cca7620ff36bdda3896d7ada36d6694f7259f75d71b333ddc998afb9f980dbd009c12c5788891ee507088a2eb174faea72b098dfb75d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3ed0269c8018a9b055116e0b76855a7
SHA116bf45e1a7a077bb7cbaf2bc7d2ae4d55676bec4
SHA2567dc7f62355d00387024eac4451f8cef8b3e87e35017be4c113fe6534837765ec
SHA51270b4800d36d9a5f84891bfb2b35920650ee24aba584b55616d992c485e6ab7587fc8f6959a1ffa7aa6bc198cf715bc535a1123cbca0ad6e1cf8787cd8964273d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ac6f8e80f6d714f97cb4d4bd67f2424
SHA17c7e89aecf71a21297dc910c8afacbf7e8d83386
SHA2569fd52ad08790502fb2387ada21e6d970cf4f1f1de1ab005fe906234b6ba137a6
SHA512c3700fcdea4ff4b8289571a90c3163bccb3df8bba8bba2c53674e2231a5fdf187c8b41a2ba6e82615cbce713abda092fc7f5a209a43ec501965f6a5a18c8cfcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517e121cb9b6ea08f3de228734bf80238
SHA17ac0ce72f761149a3602d8e8e942d55e796dd5bc
SHA2569149fe51a5c77e3588b7f33b8e1e4397d1cbccf0f8b671e617917a85140e33ea
SHA512bbcdfdd8f9908eca22c7db5cb0ad244f7a0cffb1d6794bd8c7bb2a0fcc2dd7b007bbede84d2f6a6175b46b3c506426af46cdbb6bcb4dda9e04849545e15a9781
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56de66a2dace79b7aa88d9f03c8150700
SHA126aeb162f4721de731c4c4e7ba41da664dfd5559
SHA25675b854a104b879dabfc6a754e0f5d291a3c1125bfc14ac1047a3dcebad6c89d1
SHA512c60b01a822811087ff32a9c6626751ded43bea4af7d85499ffd898fe65490c0371facf307e3ed5610df58bf08b5e5e248dd242184b94ff7dab061b2b372587bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c91508f70d508c7f9f8f678e9d1eb6dd
SHA10928eca83b8a5c8e639e30e9bc2971ab6a6eaa29
SHA256a0d6fb0d6d67800589dd66f4164a7902b6121236948be6b3c5e5e64bf7d32939
SHA51250db679eb39787ed6b6534d5d0f23d074cc9bf33b8b1d3bd92b97147fb4edb0e310bf9df9f73e2b43647e22ec2f94d441f6d1af223b5bc3b7159d31c70f94229
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593ac75bb5137fbe6f2b10b1644bf0549
SHA19825039265e09aa48be9f7f155eef11d035ae8d6
SHA256625b955a290254836388cc79e4373ce5b1d747146ecaca77d5c346446201a485
SHA512d73df0fcccbdce02fb13951e318ca90fc4a2b0f977399068bf2185b7e386568885b697fdf95f1ea8a032da8a68ee4bc862c7fecec5081335f946b9d9fc715995
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3cb2ab4e9bc1b6d43329221acf25437
SHA18b37607f493035e141d2186d3fb99109465e82e8
SHA256cdb061e082c6a722ed25083d2572bb26a97f1a15620a0c386e409fc4f15d2595
SHA51231d737e5e5c2af0e5856ee6a5b12db1383cf9ee4aab51838d85ed039e0eacf7d6b2a8ada86eb8b299decb0f61580711d009c318c275388386fe56c6c4da5c2ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dde7d366bba9f254915a951a43445ac0
SHA1f4d357cde96dd7ebbbc29b5c9be3d64212e9abd7
SHA2561af57c77037a4642cd4b9be2ece92529b00051dc4cc1d30af682c1ff115a8218
SHA512a99d8c14763abb5d3726671b45d6e40a1c112da46cae7e47e5fa0ae757463aec424865dd618e398819a749aaecba68a96da33f43aef577cf007e7527d1631e79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5130c68e0a89fa806dc272b63b6fd8a32
SHA1399c9765e0e8b479a73f677ae08fc6aef21abc9a
SHA2566d26bc760429865992f604f9b2caf8b9ff293222c3f632b88a81a608a732b05b
SHA512a6d5fe17a36377bc4f8e5c90ff673c4860757325bf13cf66d44f20525171dabe9d6f0f688e0ba3934c7b369ee7b818605f076b9607646809ccd380c547ad0b3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1e2fc2dc0218429f7929b1a3edb9202
SHA143fb006426f9705a2b59ab192ad5783eb84a1c8e
SHA256a45b4b8fecdc6c0688aace364e646260bfb74f66e71bb7879de2bbdf99e0c53e
SHA512fdf228648d21e215a88045f289e1e1b119c778df98168477deb42637869277ac34349e5e30d9afd8122d3e1ed3c52d6b3efd4eb62aa6f9fbe43785a1f65d2791
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529dd30f6307402950cb79425297a83a0
SHA1c048b76897c3e06894b9de2d40e1c5f47d4afb77
SHA256c687602b3101fb12a307f573eed7df2930815ea3616cc4cac8238c1523184bbd
SHA5127a37879649176a52157f6e18c6f3ef6d7136c152ade51791d979cca85af8947a7f795273b7672b3d41066d82c9941015f10294cf749aa965c2b81cc1215b18d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1ae7d44be77467a7717b5b7a8d8c20f
SHA12ddbaa6fca71d22a89d68a809d4266fc9cd18b82
SHA256798d5a325444213b4d8ccc6bdc6db43cf13c0f8ec4e066d0ebdb913f33e18636
SHA512542249806bed8e8ec4a907cd08f1783ab0e6944e91a69f57d1831ab5940471aaff79b7162111938339de8a0afa12f260bf344f8f56dfb559e43aade2bfefd613
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cfdde2b2996c030a58eac8ef1e683aad
SHA1d1ea5e4181f04ef6dcee2bd88cafe470424b20f1
SHA2563c66b18dfb78d57ac0c85a6e11750fda21e4672ad7617f213e2c8e370253c587
SHA51292f12923913bf54885da5cefd0e8d39c69c723800ed8f382d496a11dace8e4d83773338c84e8de8e6236da1e7a1c790bc8e8650d6497066ae0650cea60b90a57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bd5bff758da89a86a94a2eefe4580ab
SHA1c5127022b7622c39124f91dd80c11609b3134126
SHA256202bd8f9d23a51a05b649ee1cf19c06fdc41de59cd224d280d3bf09e9b316610
SHA51242b18047393d2433714cdaf9a80769a35b58f9fbad6af04e03a6d1292c479264da4ffa4f66b2dbdc1f940441c3433947d6084dd731cca57ec8a9e73fe4f7850a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504b73552661a1b2a5f161810c9d942b1
SHA1d0e7a0a4828dd7b794237f905790bc5d840c8187
SHA2565eb61083436b49a8a2db7c98fd773bc30d26aea95fd73f96e66a34c0554e43b9
SHA512ac59f183c8eb19e26edb9e703cbc64bfc0224cf4f44020bb56830ee0cba42bf333f077d90754967433cacac484e7ddde1e393a561dc58c36b507ed8a8df9dabf
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a