Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 15:58
Static task
static1
Behavioral task
behavioral1
Sample
67cff15920fca2d8ae27f43352eb9ff8_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
67cff15920fca2d8ae27f43352eb9ff8_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
67cff15920fca2d8ae27f43352eb9ff8_JaffaCakes118.html
-
Size
189KB
-
MD5
67cff15920fca2d8ae27f43352eb9ff8
-
SHA1
b8abc160a6b7bf3fd62ab8eaa2156c0b0653c3d8
-
SHA256
1a4baf7cfa0959b1cd2798d4e8cdcb4b6b5562d052e0271597c0141ea1b917af
-
SHA512
86375e466582027b4cc2e56962a1d4afbc42f6878186280151ef615052d497b17eea6dcaa357fb319ef5ae4d1c470e53964bc6afc985eaecf8d569353653cf05
-
SSDEEP
1536:SNT11BADhyDKmljCkyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3p:SZkICkyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f30fb0105a60c541929856cbdf03296800000000020000000000106600000001000020000000c0fc7b6a2d52f57714a8b05b10a3035763e35b332ba7630f061819d4acbfa301000000000e80000000020000200000003d2194fc207acd114e5889084f09dc6f0e741c3d19f6f4c127412eba05bbf8af20000000b0762643a58ebef9c86f87cbe7d770d50597389db69f4fe22ed34e355ccdb988400000003086c3e8c1350ee4e9373f7285143c18f128d21b6ca408ba89ce5f39702216739af1b14e83a83cb241a14b817d0b1b211d0ccd96fd76cc774d27cbd64c9a8f59 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0534df360acda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f30fb0105a60c541929856cbdf03296800000000020000000000106600000001000020000000ee40338860a7602f3a3a43b29d1fd42dafe33dbe1f33640a8ea933ca34e67d6e000000000e80000000020000200000003ca5991eada73bcea824caf5a3ba0e64b9c70558469df8624a4ef7490b0d442690000000133b86030ab68100ae7f0ff76e1f6e8c91086b446c6a76254208e46732414c00bdb54bc61ce46cb9f453ac193835dbcdee5b148f21f055ded72652661cb1b07c3b4b29567e7242a8bebbf37af16f97f145bcb0976e0436b957dd717fe864238be481b1dd0df352bdeed87ac9d3b86e4d9ca136af0c0b773206746136edbcfd54b54523f4d805df6e0a2aed7a15facdc540000000e9be70b6111a0bc669960bb43e119899dcccfee0c7ab5021374f0d91b3229fac4256715f8a19c8d58f50da6f4c452425d950f1bf5432f79b22bd54c9663e7cec iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422555372" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1EB9B831-1854-11EF-B411-768C8F534424} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2240 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2240 iexplore.exe 2240 iexplore.exe 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2640 2240 iexplore.exe 28 PID 2240 wrote to memory of 2640 2240 iexplore.exe 28 PID 2240 wrote to memory of 2640 2240 iexplore.exe 28 PID 2240 wrote to memory of 2640 2240 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\67cff15920fca2d8ae27f43352eb9ff8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0855a7364fec02153f8a0ac1f52fae4
SHA18de60b97851ea44a2ad750c3e5b20c4d1e4dee72
SHA256af088691eb858b266a32b4d208aca5dc94254e943fb070f10e863a0745da3780
SHA5127049cd233322f60a6f95c020b0f9941cea2bff6d23e9b1bfaa94b9de24942015e65a6cf3612a32fc03630f84b4ec888e28759d7a187d0494a6bccc8a5dd88998
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5430ad740b7f05516a021303365bbcb03
SHA1e7fdd1afcf3ac636f0521c49fd9a38892845e203
SHA2561f55cdb0d3e4f3129343d5f40a1bcd06c4f88285073577349f92f41dbefcbd42
SHA5121f8afd3173104b06b5877054f440990496a0cdaa577e358f654fd8538fa68540ee0cbd27638be7432880d23be3c6e5175f92b70a45688ae7c7faeafdb73b4881
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc6a5b370ebcf1d8b386458ac958a72d
SHA1f700febaf2668d9d84122dfd2b1a6d87280cdf57
SHA256855c1d8b77fc584a844c3165f8d8d52440b3788e36608b43bdde8226d61cdc81
SHA51274b1014ba9eda63c16821c92b92ca71d83941a5f2d8f5fd0e4635d118fee48fcaea8d66aaa2b022b6739e5fdf664d78916967cf4cede74c64eebe4dac1d631ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4747ffc6ecd32e0f2c06e324580a7fb
SHA1047459c2dd9338aceac096a900789effe82e9484
SHA2565c94271f8925ca3561ff628b0bf9a02a134a125cdba59d2c37dc2919ed04d880
SHA512d3204026ad6c871eb7530b97de86ef462f7fae2a3f260e510835c5e1ea4e2cb66177ccd33bfb75be7743fcc2957f8f4d7ed571b0f7993ad53be5b8d76043b2dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583d19260d28fac1d5cb6417c3cb961eb
SHA15accb083491110ddb69385f20a6f91caf451c7b4
SHA256072f80748cdb6df4b18693e2edba5d924275d63cf0491199bb54f74d507b3fbf
SHA512c2ea9634ac7a93599a4d8effa3e048f43f5ddff9775147c6ac6bf448e42cfe11c00a98be92763f4812e02ccafe071a706b12b850a95587ab505e34ec918ec193
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c1192987ab138d2420905f41e2d37cd
SHA18969791ecb8ffc65db07d8b0df809de216882c8e
SHA25634b312541a130d97e29f1bdea156bf78b557e29b0a9cfb742907ed4389be541c
SHA51277020cb41f0b70078f0d913871fd9fa6f8fd634469c6519c39515d83aa53f1a58491839ec12b8448a9a7e430e1960c3e9eb8750dc8ed601c18b1ed2dafbe45a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504364ed3341572677c3c14040a94be41
SHA16f57735bc982fa117b09a553c4e8f114e2a05424
SHA25690950251f2ad1d513d33c524f086fbe7a4b64d7c32411a5508e375693b617cc0
SHA51272586bfe0c11e6538b5d6aa211726afbd28f6d6c6ff627d8aa5ce541717029050bff142cb23ea5e658b0e959dc8d9f308cd7a7615e8b3eb9f23e38f7c5d6dc20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8879fb5373bd1372b6285a89bd5d06a
SHA15cfe7354c8a1fbfcfa53647c19a4e898d54f8327
SHA25662a28b9ca4e55ddb4fc45396dc8abeda9001425378ae7419938b20e60ae1ece0
SHA512866efdf1360aefcc79254771b77f65c92cdc18dd39fb5c9d56719526e1a4fd2c8d65461876cfeaa8a73ed406f4e1cb55b60c27818aedee3bba0d4efeae04be89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c5287004f4ff9425cc0a2f98f029207
SHA1c9def64220b77f70c7256accbfff31abf8f5df68
SHA256f1765f27b25a0c819b170991ec9a7625f2994f93ed4ae7a78a4012dc915461cc
SHA5127382ae4ca1ef16ce94ab8280eb5f1016e2746a81d19878078eae07ad364a23e6acc0f05329e60319eaa24d118516b7b3859aca850878925d8d3225c0e82069ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc70bb5f00dcee9ff0bd2dabeb997517
SHA1cfa97c5c057bd2b4388b48385d549e7c4aa19dcf
SHA256f70afd7111ca4e591caaae5b930a068b774fc9b67bdc0cbafac78ecbada6a45a
SHA512c05efad32d0a54b4d11c96c2420ae381fc32b774f642c183b02be649ea04ee9dd7dcc2c873e9c2ad5c82c5b532862f8996760a45c55ebbfc62d050d8c6d36ec9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff6cddf634f8aa1d181e3eaa784ab049
SHA1832abdb8a3356a0243212ca9b957bcb7c3a727a9
SHA256cf45a102aa3f9fca7ba69c925803f0b88c5b5b95740e664bda2398512ab6c1ff
SHA512d678b8f2cf5fd457c77a3ece37924b2b762ef96b5b5edb0ac176d93c2deecb3366c7954b5a016ff1dd9f9d7fd6003bc9f0a970bc327de9ea8f6f550dbae9740e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e362f5769d3ed7b65b1bf5ec4434d9b
SHA167ff5f8d82ae28490f62481b63c563e9ddede592
SHA25624cc0424a8092e040b9535f0789125695f4f7a69011d932145d62e93132d1452
SHA51202b709694d4267e0f934769e9df0cd93a06a08380e224c745a7309b0f795a8ddb8db1d1407d77e80fd40cc860c96131735886d3c655ce508ca557c82df100974
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac26115bc0fb1096875eecf9fc319843
SHA10a27363c06fa6233ea27dfbc022b5c9ca623633a
SHA2561ffc50cf1b3e3b5a4c0af74ae0e5b180c8d8306a2b5f2916264bce9558038424
SHA5122d822cc2dab021e3fee8c29c6e3d5258f980b778995f175fd2fb29d0466489dcf8582c0cc688644eb104d1384bae51e733aaeb96a06df83a4e28644fa50cc7ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c276e175f9ef621ea951553658ae2965
SHA1b27b51ba0b92796439f4db39ba154c06b40b3b23
SHA25623f300098a08fd577c199e1fd8a54707796a8d4c55155bc8443dc8c9720da4b3
SHA5128035c2d5d11dfb4190f3e38e1d6a529ae0e46e309cf024301aa915eb02dde89a17b03e756dfc4d28dc3a9d90831edc4f9536e40635c0d248124cd92596f2d8d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5867ed611672062165fe21ac4bf85ed65
SHA1247ba561c4fba9df55b4e0f82164a4a4ae3f4a07
SHA2561eddacabce19db89477f4cf8d6121c85692e26a50cadceaa96e071daf4e749c1
SHA512533680d958e83295b2ed1c78283e75560d3692a6db9f176ab07d36bd038bf5716c1fc1bc1c17dc879ac5be5ca347feb474988ba474d087b78c86f0d025ce0e3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b797160bf451232e5a67d2dcfeba5488
SHA11f5662ca76c7a789954a7478707f52da743ef38d
SHA2566d3ae1657752840c65a083bbc3277a6c22c63f556d3b4f390df5d230e3cf82e3
SHA5120bdadebe84b372cdb35a2d3e6a7062a838f0eda8e26702e3189b90c847f80603cb6a3d6d16003922dd17ba5933aa270fcbb7241e7c3dfe8bf1403007b0c0db10
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a