Analysis
-
max time kernel
118s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 16:52
Static task
static1
Behavioral task
behavioral1
Sample
67f127e017573b174dea127e64823e67_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
67f127e017573b174dea127e64823e67_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
67f127e017573b174dea127e64823e67_JaffaCakes118.html
-
Size
27KB
-
MD5
67f127e017573b174dea127e64823e67
-
SHA1
85d322f984ccf74318bbebbc2d874815c3954cf2
-
SHA256
8df0ee9b2ea51f3e6c692e483d4faa3c9e2f7ee42b7ac956b7ab601c4d94be3a
-
SHA512
20700902e7a7f6aeee62a53d1dba38f0e786abe76cd64fef59a86bbc18e35ddcb176ef25bc2e2bb2e55afc66b644f69ab868d0697fe08e8709bd62bedd815b2f
-
SSDEEP
192:uw70b5nT6nQjxn5Q/CnQie5NnCnQOkEntyMnQTbntnQ9e5Rm6lLj9Ql7MBZqnYnH:6Q/oY7pjsS/Yy
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00b6078d68acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000170a2d0008b3ba4faf07f6459a5e1fe8000000000200000000001066000000010000200000009ccb83f517cfbdcb3785d558c2d903661817e40b61be81af11a3e13ac7ca98ef000000000e80000000020000200000002f1850efe8c74bb961aaf1ec5a9462e6ca9fb624dd0686abd8b1d5cb50c18fb32000000034169b5d504be8292c87a4f1f4e3aab25328e545e554582eeb580b8fd8fadacf4000000024cae9bd61d8e86f8652323c0f200e80c3336ebaaae4ea5a508e9ef6f76002910c69cd71f9e782c82f3c205f98ae9c91578e4f0ad408ab926d16a03bf9e65ceb iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422558637" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000170a2d0008b3ba4faf07f6459a5e1fe80000000002000000000010660000000100002000000066b771455636989ce73eadb8bfe4a3d8e1aff27e06b1ee1d20c728ad84d8d6f1000000000e8000000002000020000000972c0cb0c7f0920fa6776bb976e99aa99b573925a3e3f7516dcbd7b80afc6727900000000bd87c4043cc1f0125af53be1a568ab45065c8be219cbdadc2cbbbe68418f9e2d417cc2f92fbdfb2bb6775a28ec7cdca2c073f51b48f1c8b8d7ba11604672650c9b8def6e5471a3f1e3e7a31766e70f6f8df41c282c6c1358c502639696873a31fb065f4ce742bb566ab69ad3f11bcbfde22f285a17cc938c72739670b14750cfad9d36854f563b65d0cc84c692d2d0c40000000c473df16370e0ac4d678b7d495dcbfb8b89a658bf3f6bc53d20b745334474aae3aa7f24cea58770bd9bdf7744ded6ececf800d43d09611a966450c70c811ac04 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B795B8E1-185B-11EF-9C59-EAAAC4CFEF2E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2308 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1084 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1084 iexplore.exe 1084 iexplore.exe 2308 IEXPLORE.EXE 2308 IEXPLORE.EXE 2308 IEXPLORE.EXE 2308 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1084 wrote to memory of 2308 1084 iexplore.exe 28 PID 1084 wrote to memory of 2308 1084 iexplore.exe 28 PID 1084 wrote to memory of 2308 1084 iexplore.exe 28 PID 1084 wrote to memory of 2308 1084 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\67f127e017573b174dea127e64823e67_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1084 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2308
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552eac58bc3565eb41e697ba51a325b78
SHA14973e74bc5722445800cf14fef831156c768ebf3
SHA256d356497349d6442ef7da2f1c41a020f286028579bb73b72b5fc2fbdf5eee9b75
SHA5124ee905c56d5f1d0aa5f467d2cf818d82e7780cb1fde74ccb9c93249762b76e7a700b3c27be783be26b3dd51f605296a86e82fdd935961f40ab4405311cc0e950
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e3246cdbb17487794c2d99d728b030f
SHA10aae495a93ab27f626150cd45111f4a0753ab665
SHA2569a197497a8755b2083ec21ec3290ff1ea8697ca7765967afe01034180d41c85d
SHA5124c4da5dae903b38215bb24ef7485a5f21bc4a94b15469c88262ecdc33101c8f33dc94675cfe987bc6a6f3b2577267572c790aa8ee12f3bc94b4ac7361a5741a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f17fe6564584567624e360194eade0e0
SHA1a46edd830ced22f79268e00fcb1b00aa63b332e3
SHA2568639c011e576b7f6c99e6eabfc2a734d6a9deb39b610682d4913a88a370639cb
SHA5124414d07c1f69821c6873f05cd49154d52a471ba8e4c56e633b8e303edcece347b3f87284c0f92d350b1d39f2caadaaf0357c8093ffb1930d53781067fed9b8a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c48b14e215aae97ba22ce9c5add1fa33
SHA1b1fe29580e2ae76f974a89d066982be5cd1802f3
SHA256f0168a999d691bfc1e7849437e55d37dda589b283408c9bfc5ff481ebfa1c2bc
SHA512ecda967689b54fb107e630554ebc08bf7cd63f12a0a16e1cf57c358d40419e8e69729ddd41e99dce66b2ad592bb68919982ee16f420d23d1c2f6719c2a346d9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5333cb1f7ce1704af43138a272c54c019
SHA1010ede3773e6e18fe74fbe645f9f07a3ab70ead6
SHA256b4fabbd9c16195d0fdb3bb2973c8c5d532cb26a49a70e6d5435788e0ea62cd7a
SHA5124f5bb5011c9a0b8dc898de012833232326aed8c1d3730b1e574e4f449a927c6e348d67fac7f6a9beb8912ed786757134e2c3af874d8d4dd96600e8ad27445fe6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500e6e12e2d4545d86404d8c112bad583
SHA16d279c0253df1fa60ee8d1a2468ff441231d2b79
SHA256d959e56b968b93235cb4aebb9bd28457f20514003f5e25a5db00739f1ba6db43
SHA512365aa3694c89afcb97ce24fe2c3c9a03f8e11bbfb991ace51ede6bfa07408ee4b1b409a1c72e95724218fb650eebb05d82182a170ee6bc705cbe5366a611a691
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a67d66979b0f92755ce7b0ea7aa763f
SHA145571645121c50d4a68dab1e78af7dea07e67157
SHA256edce41ecbe72042ad514e2988ccea2f66322e6f50a55ead90bdb7e3d858af5bc
SHA5123f45d4f65eb9658ac4dc56db29e7cfd7c52f376188b6911a32aeae73085696059385238c1c28ca04b39e6c9c372eaab0875e1381cdf78b3964270ff9ed967719
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b600501319a1b7a4a3602469fb42f43d
SHA173e568361217f09825bd21761f154ab40a4a145d
SHA256eed38fbe18b3e44b3a923f2a7c102e4b39247879a486523598bc2f09dd0ff503
SHA5123f55eae8b9123d17eb2a0141171fd0940855e7f0a94337255b18e4fc8ca4b8c64cbefa80f8a5d8051a3322c27bdbc3b67582a421bdb193661c0a3ddbb6446db5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d70378f62369da9224ea4f8bf68bb04b
SHA1458c4568680650b198cec2209c7d0d9fad837a6b
SHA25672f9964cad6399b168f04a05ccb08c3dca0f5fca6591226183a79a37493e4bb8
SHA5126462c08cf49c981be4bd68645fcf42e894b98c4d5b92ef928b4a6f6f05cc38fadd7664d2b92966de5260c53916b27a6d5a6a8b7c0b9c90e8e1aeb9073ad6eb38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c3d3e4625b8fcd627e835d1f9d8099e
SHA1ee875571e8eb0a86dc9fc2ca370a1e7cfb5e54ce
SHA256b00a4273496af9487e0570408aefb26846d4653974c01f4ecd97539487c0cf81
SHA512c8ff845a0c170f07e76b9f23d62c7cc881b7cd58a58d38c9c45ea44bfeec4812de2ed97f438edf6ec4846298780f5df0e8cee47cc5cd3f13533cf3f14dd421be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52847ced5107fb6330eb56f14bb73f4e7
SHA16970473b3bdf7da489fddec91d6ccc8e962ffe21
SHA2568b4ec5d4761f83a75fc185e9f67f9ca99ffd7ab6c80d121a7bec02eecb186c3f
SHA512415f4750adba9c348712c939bb3aadc292c87877f5c9ce6f85de13ad419ba42a89588bc07c9fc28e0123f9b75b8d6fe593f7ab2eb352fc7161e6941ab24605b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba1bdf75fdffb2a5f3f9c142d063f497
SHA182ea699a74b7798285c08f27e20417bb6cd68744
SHA256b7b800ce96b1c945285f1568e9acf26e8e9101819ae87ebad42ead108a71d13a
SHA512e7ef10bac13c5be48c729cd6463da3ecf1517c456003dde8907a763af2d0ff1690555070ca3c782f0a8e9f2717c79320aef779e5c4e407dead7ce41f85eb7d78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51baba802f15746275352ef281621f818
SHA1da2822b094dc39134e1a7d7eaddd24e24cf334a0
SHA2563e8fe359d480246df4b56d8e65bb0c07dd1c6e2f48ac96edf9f697253439f6d1
SHA5127bf6dc5634f336e05191319f6e4626d0cc248f3c16890b32c3af63ca6355136dd293e6f5cdf31d62278f6b51a2a11cb43c40db4d76121f3183142820fc65cb88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ede436c64e6df24404f82147218ecd32
SHA11523cc4efeac5cd022bd7079959a928a276ff4ae
SHA2561c131ad03291c5586b6fcf48b5397be920391c09c7a3f4fb203e3f9e81fe021b
SHA5123a4f0f70f9d7efee62408b81cf94aac763e0a16b28baf381e5d535352282bc525b6c75c06852e6d5887d0b4ec4500935ba35fc93359c0237623b2d8a9c78994d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f3355781f9c2a003ac5b3fc6e58f9a4
SHA19576887fbb2ea893d3726fac404dc4dc6befbef9
SHA256aa6a9bc9ac9721c8faaf02440cad84092ced3a8ba2bd025d40677dffbc7a196a
SHA512f6e888d76287feae2a49038c72d8390159f9c95ee664ed0e84abbdba4ed60df7b522a718d6729ad45c3d5534f990ea786a63a41a06c6126a1c78cc040c93f2aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f5f6bb592cfdee1b8b602dc50f012c4
SHA1bbb24d64fa71531b76754fff6ec92e4df505e0e4
SHA2562dc6e8128f9bea459e1031f24f534c9741828a0b41b23588f279e1e186ef2521
SHA512d00688ab0fe8fe88d97f815895032921ecfc0dc5acfb40ccc8d9543cbe061eb41edfa127b343844a6febe07f440a81f08ea8f418b0bd8ac19d5e78dbf60bee09
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a