Analysis
-
max time kernel
132s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 20:36
Static task
static1
Behavioral task
behavioral1
Sample
688ae6cbfb2da825cdcd4ebee846082b_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
688ae6cbfb2da825cdcd4ebee846082b_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
688ae6cbfb2da825cdcd4ebee846082b_JaffaCakes118.html
-
Size
213KB
-
MD5
688ae6cbfb2da825cdcd4ebee846082b
-
SHA1
9ec40be104233fa1a111cea7c9f52eff1005450c
-
SHA256
566cc52f7f0362f8535ecd96fca66486972bc08e4b1ff2ef74d6bb35468b700f
-
SHA512
44cbc91a8a66f2bac58c9c442a94bcef474ec865a7e02dfd2a83c4448d1cebb269630f303d217d1047b3480a5ecc087166504dfe0216203b7bddacb84cf216d9
-
SSDEEP
3072:4rhB9CyHxX7Be7iAvtLPbAwuBNKifXTJL:gz9VxLY7iAVLTBQJlL
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000227bb61f654313d425556159f18c81918b78849f917fc39efd6582b5dafd6ec8000000000e800000000200002000000099bfac701e71f1210c0f76482fb27e3d2fcdb2f2341b1e323a2abf775a937fd29000000085c7e383fcba71444b0660a5b9b596934700124e8ed54617dd2b8c7bd2b69d5c862059548eb477c3dc713db2cc74d8e089f3fc9cf535e583cfdcf5b206b8d3f8e6526d88db208dbcf14393061d01740681d43841d4b73d38bd08766b60ba01e2d1b04f72013753b80b622df98b738854e17bdf427c1f58f29b7bba622c5aaf25763d1dc363b2451ffcc705589d512edb400000001383460bcb56408d51f8829e88cb8def7004fa10f38c3646cd88805b8302303d58b6d66bcc1756dc4c2d3e607d7d903488d1bdbe4099745553b7bd68f5f0ea7a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422572037" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000005b8e5d3da1d1bc8999dd11b6559d90682306b52cf4dc17061fd0f157c0475239000000000e800000000200002000000010d2639e5237377d1c49f0bc48dfdaeae7e7e083f2d2e3c8ae847934c0e1267d2000000032835ed6abf2385b06a7b201737bfe817bcc4a8ac9e101494080fef58ef92916400000008aa5502d53f2b542a25c8df4211b3efbf6a531d6c86762886150e9218c7212dfada89200e05d070789a3ead27234c77f892403759fa777e36fdf2857e3c032d3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EB386891-187A-11EF-8C89-6200E4292AD7} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0eacabf87acda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2232 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2232 iexplore.exe 2232 iexplore.exe 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2232 wrote to memory of 2696 2232 iexplore.exe IEXPLORE.EXE PID 2232 wrote to memory of 2696 2232 iexplore.exe IEXPLORE.EXE PID 2232 wrote to memory of 2696 2232 iexplore.exe IEXPLORE.EXE PID 2232 wrote to memory of 2696 2232 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\688ae6cbfb2da825cdcd4ebee846082b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2696
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1d18579a5a8fe90dcbc9b8f50d986d9
SHA193f6405db3fe5497d75660bdb4c8bb01ada3015d
SHA25643c1e1285d53308b8009f81ec1d41cea4834cd6235f2b0020657cc003b88ef47
SHA512e0851cf16056b87ed8912140362743b71be66855b496c38256d2621a9d0df3638f9de0a167139c6221b6ad4bd129137d32e1567a4c15c0ea58f097923cae8f69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536ebccc08d2116ce3036886d47ce196e
SHA15eacae0daf7264a39d6f6b0235f90c74fbf20f31
SHA2569c501f3b33dcbc8c636f4d583fa5fb633fba73f70fcf024068df74d2617be1cf
SHA512a5c5cdb673181f008fbee80f50cebfa8c607252e8d0012942cd9461daae6b26e2af074d15bc69257261eb987c48f857cd45ecd4e748c82aac6c9e3ab3f43eed9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5560367530d321f4ddd56c321b73dae85
SHA172192a238ac56ab014566e0421067a53e95f8f72
SHA2569432be4e1dd4e5a48f0f25778e784233cdf96d880148e053558dd5b5e2afb46f
SHA5125621a38aaf193b18968cd8edf6eeacc0da083ffa727714056baf45fd4d0e6d20f933f360d61d157f4273ba37f082201d8fe8e292982c5e4840690126545b54ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe2328a80178c0fb17d504c2b6b20925
SHA142842768640757e3681206e6b51749fd2edb0b62
SHA256e0c9290f561d8335f0771bd5630822c7640e6248eeeb3b92c5ac41fb5196b5fe
SHA5123f24916fc23106908cc099f89ebf12a5f253856317df63c9b3e150c4329c4ee950b7fbc8d71b43197f857a4c4f7924611f8de0c5904c1a47dc6dc92a1ea8c02f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51afb403abf9a8d49c87ec52996b27693
SHA11baad5c204bdf5e58e692703e3a183ac69d7f451
SHA256244a26bbb4d44c725919073f40bd2142dbc41a122942d184b0ed69555c983b20
SHA5128292279af8e86804935d38ac38ea2f28009323273defb1c5b17d37c04ed25d728aeb954265900e9930d3a331bbeb3b054fef18d56d2269ff5c76b9aee1146079
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b59cf114b04a08840db4c0061aa0e36
SHA184c844e01a211ac543abb163c9889c5b2e281e2e
SHA256a795bbb6c113a8d59cb6a80f5220cead5be9ca85994cdcee2e213d35a20a3550
SHA512a50a7920bb1b50c2941ccfef3f3aff7a9f13586b265cefb3da54722956a163ae25ad5b42bc0bb6351cc0117ffe5a009864743c4d66cacf5f91e0a98f4814b3ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d0310865e2945f9345eb2ada413d941
SHA1ed4272a1f04de6b4530beb1b4e993322e03bc567
SHA256aa710d29c5ec6f964337dc19612ae021f8bf02646a2f3e3ae7ee1ddd8ab35fea
SHA51258cde3faae2ca419fccd7012c3d1a5db18541d72928668caff3bb7a69ed9040e8e3b154e81e1d284a2a3ef8c6f35f72f53de37856e4fd5abcab67369547406cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d9127fd3654816d914e4440e1eb547a
SHA1acab6b5af5a9c51a6ce88db57a32b310e2e6982b
SHA2562fc93b32c2b52a9122cc5efe15c896caa05e3d6264d8818c596f4b0443072254
SHA51231a017128233702eb1ce54cb891a09a51da433b0cb6be8190a93aedf345090716966bbf1d23ef1ee095fa97b49c189ad2fb39a4903f9f18c6e73a7a42eb0fec8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d9c7d4fdcdacb75f530a71cb4700f68
SHA1bb91a0fbdb55c3186edd3609e13efa289c2cd1a3
SHA256b56a6ede2bd179ffd321258586b923239f80913f26103579e2b3d0fb885f2a47
SHA5128f38e3475dda30c7439df816453c9d9bf637a5bd1a13016c5a43afa4c975d6d8ac66d01bc11f54b982d46fc170c106a6da3ad5d718e923cb0680580b37e985fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56bfc09a08f32610dcfc7739b3a01d0b5
SHA1db7c519a9af312d03054ab2bea969cc936b840db
SHA25696d857c0e7c6561c2184763c9c67aabdecdb899e038d6b6aca02e6a1d93d4cfa
SHA51204f261bd17ff77cca5cea2f588591fbd0a068e260947e56519e0271b9f04c68aad2a5f5922c454d6657ad6d60e97855b0290cc31f3160be7aae59053966d0e53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554b6958d6f08443498bbf7d01ca59345
SHA16662c4430ccfc8e61c0a3e92afb84ebd35780db2
SHA25631c410fe5e90db36b47cc2bb297f9b9e69a29552ef62ea7f6c4ca3bb0937d30a
SHA512ed467c5504d5aa3f6725dbf7f18f4084efe2e20c818a696bb72f3f4d80ee45ae2bd528a1d89acbf8f8e10042bbbe83a4d3859c05c071610125a4569854b9d3d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f607dd7d176ac6c6377646f47a9c2ee7
SHA13a0669953729bbe38ef269dcd34ba039c7818896
SHA2566876c8576efb2a3f119d40db8ca03ca6825a500984536e808dbad8690e364907
SHA5122e137539317a8852512f2c1c5a94ecb7de00bd2f088a0b00b8bb93ed6f46899f8bd8d6b844a6608cfe80880722529eab787ef25c9d6b51f674ae916d7c37a39c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5550265c56817a7c4c7fe430e2fbaa9c4
SHA117eacd5236024108fe145d4d66a2cf50af32e085
SHA25631b165247e8e4b91a31d09ed7e0e79dd48688ace0402c014a2d03d0ea2bfb828
SHA5124c98e4e655a532bc487873f4111642b584c23447eb3e2fd7818d0786b007e801b46b7bab2e0e5c77eba9b215bc57654ba9b45e57dcd9d0780c85b4274feffb9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5793e768e6c1f251ff1706e017e2316ff
SHA177be11f1102d91fd29b687f98fb0154470b7f000
SHA2569c0748a8c5796c2586b04a40117203c60a5907bcae8174508c6656a8d78a15fe
SHA512217d0f0df8d9eee145b4810951f2bf2a02b00a66b0f084d60879ca79dcc06448c7f4818feda38b7d80fc24421eb318ea6e7f2a5589e9e70aefc124e651147ac1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0b1eb90c60674e013075b60109eb5ef
SHA1e76f8ca0fd4c031f55f84abca4dab4783348cd72
SHA25650552d8b6a3bcc0f865bafad5f20f9133bba89cc0a0143577ce50f4167a5bc53
SHA5123498ef0a3b89d10aee5ef752ed37d422c90d2428568ccc3966386bb8d0e6ba9f473259e337eda56277158595d4c48002813796ab546c2a9310a89f89c4543f81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b485a64115c0bf40857a209fcba2dad3
SHA1471d95c3297d8a2e365f4075df92b3ce50ac17e9
SHA2562ca04b6172b44ddc0fed18c618b331d88eda99efdd99beca6e4a7fe0671b296c
SHA512f8e7f8d27f8a89b3c318374d0f432f566bebb1dcba871da4fea406e45daf4b6cdcce4dd0a948dc4a38644e74ac6840beef116ce78d0507781c29ba356d0c2682
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4112149023dbbfd367ca7f78a574050
SHA11b99b072796fa849f0d0253b6b107da711e6eaa9
SHA256782d723cde144a646a58c35b6c8623f7d8cbf5a0751691a94d3b8dcc97027bce
SHA512c3968d5f136f3a7325cdbe3a2ab8fcfc12a6f10dbaf63a675338a2017b1bd27fb217c44789f5184c23340275ce1d9d31c4c4b146d390ed98f7b2a068fa903a95
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a