Analysis
-
max time kernel
132s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 15:23
Static task
static1
Behavioral task
behavioral1
Sample
67b6e25fdeea3fa6f14dc85a5a5ac607_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
67b6e25fdeea3fa6f14dc85a5a5ac607_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
67b6e25fdeea3fa6f14dc85a5a5ac607_JaffaCakes118.html
-
Size
121KB
-
MD5
67b6e25fdeea3fa6f14dc85a5a5ac607
-
SHA1
c51fb07764ac520fbfe3a9ae6bd0cc990c44cda2
-
SHA256
bd3dc29916fbbeace49f768e1bb1f10c05f4cec7884f51a7309417d747ddd22c
-
SHA512
aff0581c2be98a2d994159054116b2e30128594eecb336124f92dc76866fa15550d1b8e55703701bc95c46430c94ea7a725be88f9aeb47c7a5a7cd6310c7d3b1
-
SSDEEP
1536:SHwvdNyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dK:SHuNyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ce295465070005408fa344a9424d0edd00000000020000000000106600000001000020000000537d64e0886c71e2604b8049b435dde128d41c2808935e37a53a1585fb263822000000000e800000000200002000000092520c6af4a594a4e9f788a6865c604518264ada34ae1ac8e2e9e89af391f563200000009a35ba1861baed3f9b0431125258450a47342c256a089a8adf8911af5230103b40000000f6baddc638ff8ef19b599279aed2a9d4ac47b32cd96603607fde952822f9a899984aa19686285a05b69c2dad53fd460ac454ed74840324aa61499d82ae941b26 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ce295465070005408fa344a9424d0edd000000000200000000001066000000010000200000006be7d90b967a4da1a15a0c724c3057386b9ba0d1b7972c180df2caba66f6d3c1000000000e80000000020000200000006490278031dbbe3027c46117842ee491d51586c42c69cc05f27192800680802a9000000052ae97e71755df6e920e212df5b653a8f5972d5b4792e07530e79fa45e76df4dd044e96f49462f596b7a41765c97d35836e61e73da8a980ed546197d9b48e2a3b1e9f63a0014a320b6047a3f963571e3efa92e59983770cb3db47c7cf78ab9f0d7736c0add94bc44f408aed5c68bfa59c77792a55ac05d8d2bcf79291cd485fb661efcb203c163f5e0eacffb8cc669fe40000000fafc411499bf0892f84b3c122838a3ba09107cf0d2f9f7437294a334c845f7e340f84c59e89d3a22e1d07d127a8c8388039987ac1cd3e96c2383d12129db567b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422553279" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8005be135cacda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F220D71-184F-11EF-A965-CAFA5A0A62FD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2868 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2868 iexplore.exe 2868 iexplore.exe 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2208 2868 iexplore.exe 28 PID 2868 wrote to memory of 2208 2868 iexplore.exe 28 PID 2868 wrote to memory of 2208 2868 iexplore.exe 28 PID 2868 wrote to memory of 2208 2868 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\67b6e25fdeea3fa6f14dc85a5a5ac607_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2208
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53be9edb8b1aa9a84300161bfa79c5a7b
SHA110052d37bf68e65a2ae0216caa597fe6bf7e7270
SHA256ac79471b2050e906e52c4e27aa5d4d8ffbe3c80aaf5a425fabb40d8b606397c2
SHA512979f90c021b94911ef4c2914bc025a0c41099bbf3d4e3e0bb9bc926997fec905fbbddddc82beb44ea76d1003b3865ed71b2855169cf49e204087fb5883390b9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c1e79897b0770bd4911beba3d5fe1d0
SHA145b83a30cedaa3db7526a528740409370aef862c
SHA256f342d46e95cf16c1d6a56afad2802ed34304e8eaa9826c7af1064e67884ab436
SHA512862404f5a5d10e545063761dd37e3441672246ed4382a38055d7bb6107854aab419fa20b9025115e1a8795e44f61b1e9be480734917fd08c21e1ab9ea81be273
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5037d02acca64391d03089662fc454359
SHA1a50fc43e14cea4b6fab2f2a2432be2805267a2a2
SHA2566bb3a346a97febdc2067105c90913dd5edc49f1651225eeca71f7979ee166dbd
SHA5122d4056564e2648956c768d2fa80b18c7df0f65ab9d73060876b1381ee382ee603f007a6d3cf0cd39df6510109be05611cf55977f4017f1acaf283aba6efc76f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5192967e898b4ff04300da08a06703575
SHA1e6871a12334c6cc499e9ff02e4a03ba8c1f09f59
SHA256c6c5418d71706277204837b662faffde9a22b6888ae57973ef16eee700d0a08b
SHA512f9dae158da3dbf10c0924aaba5c9a8f0cbd68f9681d6a50e0107bfd3c48882e2d68705b7dc2cd1b1902a5bcee0b3d3f01bd33378dd1c794e29c8c7f972942e9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5794414b0acc824e244c74648df191709
SHA1a779990a68a39d46b6a6b8ce7aa68c548beab07c
SHA256d40cf3fc4b8145967ccc198636f09fdc90bfbb772bfb548dbbf5c49ed23ab8c8
SHA512d08541f190484680cdc8ed01d917ecb80bf1863528f77986f3e8f47d413c517afc1138d617563ac0a0f7805dcb0a67be6998209e99d95efc48819198932aef9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519eb084b6f289683cb62e18121a051cd
SHA183caba17dc9e916cf01d8a83c594c079db7b4414
SHA2566629063af869f48d13ec3a5a3a4b2ca4086fc8086e174ee4e0819129dcb7d27d
SHA5127230e9f0992c35ded0f39aa477707b4d6b63cc37f9e42a04f87097ecbb29dfd1843b1b72b50cfcf3de058050ed5384c6af88b1d249c23264dfba6c43f261d2c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51317b9c7a04a43bc4b049a4ae7f8a7ee
SHA1808441a47992a0ccd47b7397eb447dbfb3bb7a96
SHA2562f95bf5d0bee1cd6ed9ab9125b31a343601e8f9bbf1c1baa5d84346e26b8fbbe
SHA5128d74c4b6c2c64546394d692f32d25ca3093e3a55b160d100422a93d694d7b21beded9050d6600501eafbebca9fa5997217144cc21c5f5b4fdb0976d62103ca38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc7ed4552de72945e0f5a615f0611e62
SHA122e917e3eb766d3bc2d52a7ac0526b93e4d6e9f6
SHA25657d1693dd2cbe81a6c6a6d8b27a7437427e3add00f2a934af5c5f863fb1cb556
SHA512cd1adcd6eafac12e724401b8060a38bdca00bc8337308f54b1b4660351b7eea8b9d1ce4a3caded64d6d321b9f43bae20507ed0391a98eb7702a5e0a2db2a9f3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ce31d818d1c918f6e47315d64d49c74
SHA183f4abd358cdc871f1d9eb9d847770fc73fe0509
SHA2560ede1e0b11901e997d9559e4b96bd99330572e41188201566289a9647b297e13
SHA5128126440694a17e3704be98e3fca35294188e0cd500aee92e2c499e79f80dd5ce40a64de5069668d959b03532ff7af01c78d90a9ed914a96d1c238a561871c1d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52276ec81ec60550f9cb995c20d8e02a7
SHA11ed19ba5f77ce2bcde3ab28d3b2ee5fd1bf92281
SHA2560aee238802f706b6da786ef414d95735739cad82db4ba67ff185b4777783e08f
SHA512baa7dc1fa8fe3b167b5862d0beb3e6223ab2ffbdbda892876b8a80771b27d47dc0b729dceb9eabbd080c9d72944685b0e33109152532e474337886ffabf5dbda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b6ddb214cfafbf130f59a9ce21d04a6
SHA1b3f2baf45817b11477825323fcb29ffeba8802c2
SHA25687341fdf1b29204006411552c08606533515328e9c174296e401557aa18f419b
SHA51220933d60dceed0353c567459068ec59b4c72baaea8a93accd78eb4c0c1958bb7038fc3ed624fba9f4e6d3737d2ba5312c4d5579e52dcb221ff5cebf40eb488b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55bb802ca93e0ce5f4350a9d63efb10f8
SHA1a7f55c0d9f33b12348843366c3cfa2a3f87a297d
SHA2562cede460a593b4f555a51dad4238be856e7bba572bd0bc9b3eeee704e862cf51
SHA51224bfd9cf6e8936a958f87e0589b7c9c6bc5cf3e8cb54f4e6451b9d677904719a620a2dc13c856491fab2aa3016003a8c8956412bba4e7c3d11badcc897d6457f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501b7b06d345584dd332d99d9c8f12833
SHA178d03b5a677a114a14ecb4a2f95daca9f329731a
SHA256036856c7b0c50549583c46d07db76e8f2485000bacca0d8387d4aa2568bb0f66
SHA512b51824dd46d39107b4521ce7042abb82a887769ad8b5a7afc0aabbf8b49001a8fc17c2c27348f51126e0a4f172517f2c710700d3f7f05435b568a6f451328216
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7995e667316ca97e9c6edb5167fed40
SHA165dc43556a1e2bd5457259a88e894ff6ab3fe677
SHA256257fbac669e50ccfc9aa0ba745b17916664ed7e066fe7bde3e09a25d05e9145d
SHA512f1ea0e71ede772760052b95805ff31f292f19a2086fcff0582a6537889c8a227517a4ea2ce322a91c38edfbe20663ecfaf641a65a6e7480b0c03ee1b18d8a4ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6e81463ab613384f0505382c0e71a49
SHA1a2e4199150a6962abbc4d42a216a6fd0ff33476c
SHA256f3dbe4d33d4fa866cd52f37355169f8db13eadfad69b231968b0c2b2f4bd3ee4
SHA512f4a00a7c8399482ef593ae7980d93bdb9dc65d0adc852866df17729d8abcb65d7d70bcc730e0bfc6b920dacfec5a7e2acb7d70c216e85bded0dff5e28aa32324
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4324de5a1513ad3f0cc13e29ef4ec62
SHA191633a052279e92c78e6a8929552ff76f609d692
SHA256cb97fe35d759f6416ece8a577abe59437f06760e4484debae2fa2e94b9abda73
SHA512ec6ead1cf9a7e2e551907eeb538bc56f3a9cc772feb768938803533f91bed9f357d8f55713fd47f8f534c09d3a96e7fda5c9298d3c79b84a0bdb01027685b3a3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a