Analysis
-
max time kernel
135s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 14:40
Static task
static1
Behavioral task
behavioral1
Sample
679be4a2ae9b2aa4cd60907caec56b9b_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
679be4a2ae9b2aa4cd60907caec56b9b_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
679be4a2ae9b2aa4cd60907caec56b9b_JaffaCakes118.html
-
Size
847KB
-
MD5
679be4a2ae9b2aa4cd60907caec56b9b
-
SHA1
e74e3fd1308d36472d4b11b4f5305348394f43cd
-
SHA256
be699491df82e05266be1adbb56282d0eda1151308f122bb56f7b74f8c390bb5
-
SHA512
cd4b81dc1662bf16333205b55f1cd925056cdbb6201dfc7e4f76d9f855bb45a34be6ba5c2eb628cd3efb12de33b5bddc5069e302cd662d97ab93c9084aab3ec8
-
SSDEEP
12288:z5d+X3N5d+X315d+X3/5d+X3l5d+X3Q65d+X315d+X3+:r+R+5+v+J+T+5+e
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4C0CC031-1849-11EF-8859-DE62917EBCA6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422550726" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2504 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2504 iexplore.exe 2504 iexplore.exe 2904 IEXPLORE.EXE 2904 IEXPLORE.EXE 2904 IEXPLORE.EXE 2904 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2904 2504 iexplore.exe 28 PID 2504 wrote to memory of 2904 2504 iexplore.exe 28 PID 2504 wrote to memory of 2904 2504 iexplore.exe 28 PID 2504 wrote to memory of 2904 2504 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\679be4a2ae9b2aa4cd60907caec56b9b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2904
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5596d74b913d958f4a6ecc93c471521ed
SHA186e3053c5d493e279cac14f916b9d1545f69dc4b
SHA2561ec0684f9406543d922f9098b98ae64e87fbb059f0ae8ece47e4f89591f95eb0
SHA512fb9de4e4c697ea01eedaf50c9afc7dac59897568731af9bcd20dbf1f987c251ca53a8219c5218424f8253a00d29c4c85798acb594b635310b04d6b2e7bad3f0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55306cbbc8f4e8b0b816379d5dc5eef58
SHA17ec76e61f63248bf14a610916c9e1a8e2c40aaf4
SHA256454483609af569df0067028ff464d03ab71a298a1a15a29132b5bff5d2e43248
SHA512acbf8ace740209b2282afaf72a03fc09ebe819bec08c73eae878f097a4be71ab85be72a46beaeb54e7998c82eea13c9d908ec43b21073dfb9d3533649458e47c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578c1a65881dc99bdb9723fa3d69b730e
SHA12c6c5093a3752935285d84eb1ff0eac1d818e688
SHA2568612116f4459cd57be8ff100a4e03e13579f9ea76b6055510cf15afb911fa392
SHA512d43e7276ac2c51dc481fa380a0ef3ba6cd27b82cc22b2d1e956138d8c60c388fca26decae1f51ff6aa48c1628d71d4247bc306c3cf4df6255e4e251f7aa57532
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1f807d4e31d36ecfc591d9ab6b3c932
SHA1534ecc094a718efb414b143b6bf30447923d0f95
SHA25674b482e270b61dd85a79812a3dced157a7b9066184913095aa7f95ad47e09481
SHA512ce747b8c2caa0dcc6cf18b004665a550dffba8935e920207d6df3c54251c02e39df929c24a3cc85ab42626dd6e02f62711b1bb634999c1637a016e12ff43b4ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a1ff94a411bae3a04656019bbf3ec0d
SHA1d2ab8f508872962c1fb8925a76ab170d936529c2
SHA256dcb36c26636b1c61764f3f177e2368167d64827ff8b6727e0e858748a4d3d6f9
SHA5125219dabd712fa999ea1cd59dbc8eb2a3967152f2cbd6b80b35911317a27b58c15ce037f45335325c20693262d2a6bb30b5b39ded98e3364ae9b20dd3549a6b4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ad10a7c191499c75075216940d85fab
SHA19b9654b45d00462f3b5d1b72535b908a8a0dd17f
SHA2561765a1dc9a4b3f4dfd5849da61326d97dbeff4ab8ad91bdaa9cf7253e5830b48
SHA51240a68bf4c80c1331584d43afe163d8e1f62f25abcd2317ecc46030ccdd0009184f50eefef8ccee54bbb2ed365b2f182efad9370310872034b5cd9aeab0d9a876
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea5c8a678dba7c85287f0c36188b52b8
SHA1b21ccf7cb87de377cf89d845a83f942505020047
SHA256877522f4ac40fb1630771bf4a56d93f764a0e8866450130fddd65cd7b55b6aa5
SHA512645563dd8542a51ba5e9361e3ad43d6cdecb261bb7144dba8d71ba9a58d904aac57d58111ba25fee1e593ebc5f552d366c9b950a8db1be803586d4940a04ccb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582dbd09391d32d4d0872e1d7ca217b92
SHA1a205f2cdd5e3f956a7418d82015531083c56a544
SHA2563aff22a4f7924ce4d24b9f7b8da43f047d8633ccbdc3b067b430044cd7a3bde4
SHA512fcc0c7c32d5c582e82dc706e0d9111e04761976c39d9cc91bc04ce6cf6cb1b2304889598329d1582903a9b39e32400218a63ae09be0d923fef552626d6d36e88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53788b5a91590a0c0c1f8cc46994b8495
SHA1301f6b8905d1688509473761b41c39f9bd324e54
SHA256b9ebeae1719be127e398b5ee2bab3a60975a1895926a8b5a119de535c0f3904d
SHA512fc2d57fd8352b4f706d15887116ef6f6a214ab622855b8979a423d3924ff96e3c37cf1937361b1121b486577dc2f0b38490773cffc2b7a324d50105c1149252b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec4165b3711785adacff70ea6b645516
SHA16a343f5534b673a31c60bd1582f0bf8feb986d6f
SHA256ff4597ef3f7bdc9818ff8aff89738e92f255ff2ea01529b0836ffb689a8c6a8d
SHA5123d0555355bdb03eb93a5ef03d08cada0b4fea3afc6f7902ac9b5a8354b28b8b4adfe8aca5397a8f6bacbbaff361216ec37e84508380bbe5b523037a34815d51d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad4899d1822e19c20caad43f959d0b0b
SHA1d92310f78046592e2c86ccf2d9d7aadff5fd8652
SHA256e8841e5e2173abc2a0e5d8ec704a19ebba7f980e9515899d85655bb30ceb6c19
SHA5128fc0eda1a0bf33d2ef6f170e3ed3438d65c6ebdc76b460d179803032eed4f056c18b377287ea4f48d9346ee0a352d87d4cb970f140b2675f77fd4c5945394459
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5fd146fa0655d85734d83ab1abf5e4f15
SHA16dc5a2e7fa285accbdb495ac2097e92ff7863985
SHA256b31e5aa3e6b8811d85d0c0dd3bd281c744f6ca594efd7d618ae5a1431a438bc6
SHA51294e5d49f72f7c8688f4d7d0053a0cf5a81ac81d29c3029221c72698e502ecbe6c19e857efecd19fbfab7e931ffe93ebd8ad786b66221f51763489414b04c486b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U8A9A2DI\kefuqq[1].htm
Filesize1KB
MD587379d193e0f0cc5c380885bd81f7fc1
SHA1d8f020c131453361eaffdb60d61a5352aeaca971
SHA256627faf6cb0b14b51cea8661efc4803cfe08428b1cc9aec86ea6d07ec07606412
SHA5126718db7f245bf0271671b6eafb08c6c4ec24143318076c73f683fbf344ea40b3d90627a9d7ba226842aff3143b272d1177b3e3ecb4d4342ccdfcbe865e786c46
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a