Analysis
-
max time kernel
147s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 20:31
Static task
static1
Behavioral task
behavioral1
Sample
68882477f40a9a7e384865acc89ecab8_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
68882477f40a9a7e384865acc89ecab8_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
68882477f40a9a7e384865acc89ecab8_JaffaCakes118.html
-
Size
461KB
-
MD5
68882477f40a9a7e384865acc89ecab8
-
SHA1
d2a3cdba6a2e3d3c5907f0e77bb2b37bb616a24a
-
SHA256
b743d0d05e7c30ac2cb84f9e402b487aa03675903db2bc31b67cf93cdea66852
-
SHA512
e3fb8352110b3a9c2f791733965999c0e594a2b271f9c22dbe894f53005cfc92a68dcc98900e73b7789aa7ef14a4fb6fb4e9155ee738b39dca8b797368dd7263
-
SSDEEP
6144:S5sMYod+X3oI+Y3sMYod+X3oI+Y9sMYod+X3oI+YLsMYod+X3oI+YQ:85d+X355d+X3X5d+X315d+X3+
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{563C16B1-187A-11EF-A304-E60682B688C9} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e4f52e87acda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422571819" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000077d338f686724247a590b41187d0326c00000000020000000000106600000001000020000000ce62571d7a183dd59a5619ac8f06a91f48193ba0df6b9265f514ef8e486b6487000000000e80000000020000200000006f75a36b95461c19ae551e73d39e31595a7f6efdb0cc130a627e6f9011ea89b9900000006276ed20e10c3aebbf52df9436d7b917b260113578f85e4482dc1cc65579830ede7b4aba27024cc428fedbcc40be964aeb07936a7bd1787a65d419046ef2d3cc41bab2a10f3704350616645f93a96e47e43ce9cc20ddd676c19efdb06314c42dc260204c6cc48e3f26259cf81f3593c3530d2d3db2266912cf7ddb63d80dcc569a6d7d19c77a4f91a018445f0e27a7994000000043e16c9cfa8aafe988104b014ed2dfdd758cd7e4f809cfc92cd5ab5ec7d13c6cae9caeb03e3375bbe05e917994c5ef40c3e4a0b015a9e3652f68344428f7f515 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000077d338f686724247a590b41187d0326c000000000200000000001066000000010000200000008ad2f34e3144296e03930b26705ac9273731795b4801f345a6765dfcfeef9f4c000000000e8000000002000020000000142e1e05648f5b861df8372219ad1cb3a567bb7ee1fe2a218d61d4453252f23620000000498ad77475fe5c5479348b9c7fd3503f8874adac9ae633bb63032ff2d352be824000000013d2d39155a6302f015c5b05f21756311048a776aa7f1f298a56d8309655b8b487901589f725f05b653b90b5cc3416db1e428cce5edcc4cbd357f9bc20dcbc9f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1796 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1796 iexplore.exe 1796 iexplore.exe 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1796 wrote to memory of 3004 1796 iexplore.exe IEXPLORE.EXE PID 1796 wrote to memory of 3004 1796 iexplore.exe IEXPLORE.EXE PID 1796 wrote to memory of 3004 1796 iexplore.exe IEXPLORE.EXE PID 1796 wrote to memory of 3004 1796 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68882477f40a9a7e384865acc89ecab8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD519109c71532c987fcb329a6f81082d4c
SHA18595b8043cc43648a881250d54af95c9b817e97a
SHA25622ece3536ea358e6f1205f211d5ce33f290392206f342e8e2cad154bbd12a2b1
SHA5124dc7c0d56e5a8d4798e2ad3aef12eda9b1ca6e8c12ef22fe3b2f5f2fd1abf7173a2db12b17fd36f31bc59042328de5c85bc36597d5810d7f90f79d2aa69e69aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD58c3571558f56c1ddaf6fc463d8ebc36c
SHA1fa33d8531e859980eaac511d78b22e8385ffed13
SHA256be1e1387cbd356dc968eeb2f4b758e82d356c88eb63dd8ebbb7ba7a2f55375e7
SHA512be103ff5ef30cc91228f341f411517882dc1b1c08509bc591d072ff999acbaf0e6c5a23c7ddcf880751c19e24f1b684a41504ce74ca2036c6b945f0c8c110cbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5af1b89b7660de3e0f53baf14b855458e
SHA1e68ad8a345c2a9d970b12e44ed5899365a04e72a
SHA256b3307296d22e779b4dcdd3f36986a29abd2717cd5af24d22dff2b4f6f3eef01e
SHA512d3fbc07c19a088582514a05e0d2d8b844e23e141c232f842751e37c4cef1cb54f0dd266b67417123f1219193025c4297f444f08ef126984533ad3a441612a3c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5220de644699276e3a7abf0eb73075dcd
SHA107f5b2cd71280eafca3fe1a196e5909c409eda52
SHA2565146cf8195406a3cbda4c3532252bfb0dfc624ef339ea4d54d95e5a8c849b4cd
SHA512a691c2428f7623d53ab584c10e54a60ea094037e2cc9b52d614d4a56ef0022aad24b1687e8b35196281cdbb90f85e94671a103bc54df15d2401e8f4563ae6500
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f6676f07cc35a52c235a2b3a3fd0468a
SHA1f7d7026dc02aa4217709539600e7c0ee38fd4683
SHA256f4eaed3af4335c6c4fc151439f054d7a9451ccde7d555a985675057cddc12ea5
SHA5126daf40fe4eca41e80ba2f89265b2a85ce4a626090d687a380a83db825b727a97c6097ab87de77f733ef777b78dcfc8d5da80420ef51aa1f0841ebe61833b480d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD579805b18cd583f2917e6dfe6790ae09f
SHA132ae1efdfa9a73b5e049346191516bd2ed12d8dd
SHA25638f27db4789c5ba42a9defa095a1ce5e9dd5e0ee7e6eae2147af0f47bb9f1000
SHA5124c12e2b775baf40db8d0ff30023facaac688215a62f447c4e29e8930623f0633ddff4142e1aa3cf5ab11af7d4167004edea57535dbc081ea866e23d7d7dc1656
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5adc67c615a756469d57c675aebfa8416
SHA1bef7feb46741b0dc375c77f984ec2e8e40105ba4
SHA256c944b2e8f933f0a42026c6efd61ccea781251d386a303d3cd0fb72b425498b85
SHA512aac47caf966a117c37a497c32d37e5c2ca70851708b63cb53800659ff5f6a8ad985b44e5603b821fc381529544d47816eb47fe8815a2ad395a189730b06867c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5adb1e34a1ed2e03c489816d2a17a8383
SHA16b0c7ddf9eb194664cbfd1899593079b47ad3b6a
SHA256da718786643f5fd3689efc2b6f5b091e94c1a1712cead3f0f65acf953762820c
SHA5124c384b8ecc09aa634c2606372d07d06c4d15ab1b02ad9aab6823d02aef8efa6e9b0f6b7fd09a238bdbeaf8a966cffdc41a2bfddb3ab2e42c993bed58db6dd79a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5bc2006f95513ed7c325cba2ae2b3826a
SHA1e4328e7b37ea94b7563dbf76a43bae8623e23f11
SHA25604b80e8413fb7965e7a2a510c0c143fba62ce9b319eaa7e06be15f7563378c8d
SHA512da2ffd0a8a41d70ebc4cbcb4be638b2bad86de9746f53b8037b863803d0d36a72a1066f195f4f7cb57267aacad60b03b2a7f004314708b9df15ce11dc5e8806b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59ffda480a091e89065e211bc575fae03
SHA192c3c8f2b28bb1ec255b2adcb849899557c72342
SHA25611128538ca457153b9d02605716418d9471d099a9c89bfd193f60ab9f2b0e670
SHA512410bf3cfba19567c10184090074547e3b60aa5cd9cb1529fd853d85e45c831ec9b2011f0286ef2bcdc6ff01e2351698ad144a3b6211c55ed03a2948b49701efb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5bb2e6e22cc636bb2e715871e69be6ebf
SHA12e53fcff63274564dd8d18952ad8ff96b7ce8bf5
SHA256e3e6abdac0b7a9f6c1121322851d183f9d4e21308e5b923b9abff3ce521acc6a
SHA5122005ed09780c8baa066a8a56102929cfd33530ca4c4102a6613a26a592bd6185ec9ad3d45c8c6c5245afe9ac17d4663c1400d59a392c3c099618059ea1190aa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5aabb00b6ff09f1da03e2391a75462cbc
SHA152a4d71a4892d43f8f9f730eef24e522bb6ad5f8
SHA256fe2d504e44f387daecffd358d68363fed87949be0ab49c287a7e617b3649455a
SHA51255a9e65c79f3b152a503f4833b168e0f0c8e15b9314ec216cf74f9c713e385d01c6604bc34369e7d8541f54dea49d758950ee2bcf16ae5608611d7f8cbd02aa7
-
C:\Users\Admin\AppData\Local\Temp\Cab477D.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar54A0.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a