Analysis
-
max time kernel
144s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 14:19
Static task
static1
Behavioral task
behavioral1
Sample
678d7740b538ad76efc4cd2d22d775d8_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
678d7740b538ad76efc4cd2d22d775d8_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
678d7740b538ad76efc4cd2d22d775d8_JaffaCakes118.html
-
Size
139KB
-
MD5
678d7740b538ad76efc4cd2d22d775d8
-
SHA1
69b97601512cc57b5863eb35de080859c908bd60
-
SHA256
2d77c41c08e1c0b955e89d92b8dd12d1dcd1823e7d44343ab279aa977a3b6e77
-
SHA512
1bbff7c3f1debdb5bbf7d344cd1fe7c8fb67b60afebbb656bbbd51d7fb6d74afe669d6707ad4594d599e9ac2e296a1250856920032fdd19d731effdf94b48e48
-
SSDEEP
1536:SaVgyBsDVmHlmyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:SaMQEyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{47BD9981-1846-11EF-B2DC-EA263619F6CB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422549430" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ebb8ec09962e654cbcd1f4fe733034f300000000020000000000106600000001000020000000a058132e29ef063155ef6c6274396ef100223b7a100b4d302d295369f1be12d2000000000e8000000002000020000000823c599cccb694f70075cc2455a5cdef57e492eb4211fd963d4a41861fe158802000000045e64fab108351b34828c31fdb3e286fcc08985e369c32a3dbfcc60b9056e68c400000001533aa6f40a7d7fea59bc3013819756970b4af656b0ace288e37dfa3b90761d44f6c0713317d82f6f09d87d7e38cfbd4fa7ef61b8323c7daea1c076734644d2a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0419c5f53acda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ebb8ec09962e654cbcd1f4fe733034f300000000020000000000106600000001000020000000dcca30be33896423ee3e13ab0ddfc8728144942c2ef86891069ab0e08ee98a50000000000e8000000002000020000000fa3ba463b7a0539457d710f0492c1a7210b74a6d498503f7711f16b32176712190000000e696418bf74c86518bcd982b86714c430e876fa8a36c0f618674751174e136d6c4918ce3540b2d91fc87f50ccfbb549af6c58fa2189d19639b44556cab8e61d7e07c97fed467bec1364660aa8de64dfeb3b87611e9b64b43ac9e696c620989b42cce024ba1f9c08848a4e9994a8dc343341fed0b0defd6a7fb67849379d9900b2b4b2b7c98034811d024ac8bc3b7d26b400000001b613695c5a7cca9d2a9a943026342980317f32c473041a70835b4f76b22f2ec993e1493e5bb5dd5c53f0686ea30896ea9a14e2d9354015573b56d7f87eb7d31 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2888 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2888 iexplore.exe 2888 iexplore.exe 2456 IEXPLORE.EXE 2456 IEXPLORE.EXE 2456 IEXPLORE.EXE 2456 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2456 2888 iexplore.exe 28 PID 2888 wrote to memory of 2456 2888 iexplore.exe 28 PID 2888 wrote to memory of 2456 2888 iexplore.exe 28 PID 2888 wrote to memory of 2456 2888 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\678d7740b538ad76efc4cd2d22d775d8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2888 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2456
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5931f84c5f9746fb0c30c00d19a80e277
SHA1cc59efe50b6c1ef86c7ee8b7dd9f923cebd3dbed
SHA25610afb9aa3462a2fc7a441133a7e21bbe2cae8b164a006e39bfd02189b32a70cf
SHA51207bf29b605f8b707402d8661d54e0e034ce4176cb01a469c7980fcbb731ff7616aad09f59c9a4126b26b28a7659502ab865ad6843a5ed749d26209ece8236f0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e3390b82bbfb70450e23b86578f2535
SHA1ebd5c511979c29138df736c03c8ac62acda23e7b
SHA256ef16a84b694073cfc78d476eaa5b864b13d8dca3292582b2ee339d156445f989
SHA512a3848a7421f1dca8c6412a06655462bbd73734169c9aa134ea738ae350cdcdd29ebaa93784e84d8d509b139ff2a14b12673eccb8029f24f447d5c38832cdb313
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d4361994060ef5af7817b7e2e740f62
SHA1139a967dc4ae43b7fe81b9f49fc0203cdfde7819
SHA256c7e00cb309a9dc4f66d290daff5482084987d6ed9b77f3acb3f251bc46d858a8
SHA512900ebe0756c12fa6e61262e80ee455a3b322af2b065846f91d321655c434cd548128dce65a89fb70f6402484daa8c8610b487940b1dede388fac574ef0173f66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f26e6b3275d792f596a3b20ac10fa91f
SHA155f1619ba907fc8e3e3aada446d3c5f9fbd61c09
SHA256802ada235221bc2555789da8520bf03668c8f69855b76fc322b6b1bd9a214813
SHA5123e3daa290ae7a3ec2c074ea3c543e53a96f548fdc0479a0657ef0dd919ba0862bf86bc8936f38d33c763c79523dd0dc5b8bfd91ca771b701ad013f5c972d1591
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594bd7362ca8cbf5d2b02ce461d4575db
SHA155ac194dec63dfed06ecd6174cd6840499ff0ca5
SHA256ccf87d1c6a5d12e0c2bb3754e11a15233dd41cb2c5ab74145b5fc85a642e1cb6
SHA512ed146ea26080cf6e9763c762a6ec9453f03bd8ee5081c3a88479b2c59a19bd56359750c43dc70204386c12ac6b965bb6852f9690c8912c90d0baec12b4419ca9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb9ff032a8f77e86f4b0edb62508108e
SHA13aa7d5ec0e12c0bd227b1b01f95c089f465d5605
SHA2560be6da203c3f5558fb27dc11765d0f0b38ba7247b558ad026068fd9583d90e19
SHA512655f81f05bd0f4e0cfd4c793c7ac77a5020e23b8311de6deb34e677c963b7b75747997306760e92b739015d7717e1012ab072b12b51ed89e344c747e949f6627
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f644a5404b5f2cd179edfa687771331e
SHA1a1f719d60e2d117bf436e9aa80aaedad7f51ae62
SHA25665f95e02e3e33eb7b6fce2578ea80e025380d8869b18c5e146ce6d4cbeafa0d4
SHA51256e223bcc0a4e514a1314260b212899f95932258630cab4f073e43e437492d1729a743e788ab784198494f2f35e03cad86a8d274552838be5d5446e9fade2888
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f478a9f7b566284e1e78c272865532d
SHA181d922b2a4f54c35e8b3c809c4c98d3ab107201e
SHA256cfaf4454721f7c3e06711af9e1489a423429bfa7d30665fbbcaa9dffe3ca0c64
SHA512bd110b405c295640cd6327e8f084fd2197451e48df9dd85e827071210433b3e4ac01920349e27f2185931560c77884b26b8209c06c56867bd4e0da421637b9a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f5936888b26b1e521897170ef3ee4a5
SHA1763a6aea8800369c64a7e1985a6821c671cc0f09
SHA25607100ae3b13fb9e6ae2591c64c8604c4305ae58304034f4765e86a1c0b50c154
SHA512b64af6c1d5f6fb236fac8cb32a86fdcd85592103885a3da3557d3f283ef8ebdf74ebe65fc0101386808e9b200b803532e65d01c6ddeea502d7a2c3c21c4c1147
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7f13f6ba980b1681f0b248485d85e6e
SHA123d8f0a7813914481875cee53c91847ba2d6036d
SHA2563dbbd0f97ae016b4824df86aca321f61447582414d26a494664debedc07b0634
SHA512054b1d8bc134c5a420f65318d2e55eb287038dbb5bb2847e16230fa92f8265e0f095b67216644200350da8f185fabaeb06d2701434f764b2c8ce5d21123bd311
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536865cd707e328f7d68270be4e4485b3
SHA1bee42777f3e11a156e51723b8821a891d5bce173
SHA2560a784c3a0fa07e060052f88af1748e53c193472d5cb8c4a3b02840fefb3be9b1
SHA5125fac04a0bd458e03930b616f5fe8c809528833510d14f887322450278da5b6c1996ac69fd22e7cc1b5f973a523222feb13b9226083f4cf48360bc517d2be9afc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56fa454007ef80929639b17039266e8fd
SHA1e431d6742361f9bb9d7509ff444d9fbfe18fe660
SHA256469f90991de751a66e860a6e6fdfd6baa1f0950cff668b12fbe074c6cf8d56b7
SHA512fb25afc01cfe4c2a2c8f96709e879790e57dd01de80f38efd0af36dace8a10925c62a9af0a7269ae021e0326852775d457a2e0902c3ea84536bf4bdac5ca35d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58666950567976eb141f0a15dae2efa3b
SHA1b6505c2625f50c289b4c88b17e4b736f5b65dde4
SHA256f86c736fe9c1913bbd46b5375a1383335aecd60c75d7865376df5587dfe0dd89
SHA512432cdd374a18e80c2db807e3c40a04b7def536b6e1e245846c0778192d1cfa3481a93180e62f16563c1482b65333d34ce3d652f688d6c30225da0263903cf509
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561f83faf5541413bd3b61b82e67e60b9
SHA16c74a093e16db5ef0ce91b83a139094bf0379991
SHA2569fe094923f0a28a9212d3047aafc718e64d3dc4fcfb3a1af4c7ccccb1c0f28ed
SHA51208ec13a8254cde27b28e30cdf68ebeea54768a4f8b4afbb561b5643bebf7252e9f0b3cfa6014092214bd433b4b6c2969892a1be71475df80c609b86bdbf3b040
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a7c552e050ce14a4d17231a867894e0
SHA1fc4185b5e717e6f46edb87e9a45c45f418689ecf
SHA25663ebf98bd60eacdf3ed83b06776be1bad97631f794dcb8cf28048f3b9d15e831
SHA512f83a11e1b753a5dc8346bbfcb13bc9c674b014521c4605817d2050322e86a61537e31d07ecbaf2836fcb6f487578ff56fc1d700c887f8f16e8662d027ee923f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5823bfb3a8215cc81a9badffd849addd1
SHA1daf61e8670a582fbec8244afc8b0189b1ecffbcb
SHA256ad9154f9a3b54e922c32dcc8919d3e1c55ddd4390870435cdf09b21b2bba7a12
SHA5124a160a340d93507c948b755da4d4c447a6e957e63b144fb1b326743f1a6356bd51fa1bf9870743be963e15bcad20496599b11c545dcd591ec74118b98ad26088
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a