Analysis
-
max time kernel
142s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 20:36
Static task
static1
Behavioral task
behavioral1
Sample
688ae7d84da3460f9de4110228ef55a7_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
688ae7d84da3460f9de4110228ef55a7_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
688ae7d84da3460f9de4110228ef55a7_JaffaCakes118.html
-
Size
139KB
-
MD5
688ae7d84da3460f9de4110228ef55a7
-
SHA1
65de181459c6331743b23e68dd294a89aa596a7e
-
SHA256
541f90db2d0d7a7f14d0ca57731688f4bb6e072bf1374727a5ec5fa2d6cebeaf
-
SHA512
9dd1680f830e4d1df4d5175cebec37533b14a161515b64bbb19ca86213c1b40aaaccd2c362aacb75e32f4cc42f0093c7d589e9d6254bbc33756b677ff1e4c0a7
-
SSDEEP
1536:SoNryalIyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy+:So0yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f528d0cc199e4418ba1623086919291000000000200000000001066000000010000200000004aaf17ddb60cb931149b5851a1451d9def56fb095eee307f2642eb000aa40c5b000000000e80000000020000200000002fdfec5df3adc80e018cf88536686ce160625fb9fe3b8bdcaffa6ad23615a0a1200000004486613eb8a9d33d15dc27e08c79d27e0ffd03c4be781e3cd911d09d69d2969940000000710a31788f2a00f41465f10a823e33dba7e89e019008978831738c32312b29d76e6575d847f563ea939d24c75a6020b2a990814dddb62a6feff76a77af05749e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422572045" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50fbc60488acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f528d0cc199e4418ba16230869192910000000002000000000010660000000100002000000045fa6950bd56a5d3a4f5893860fad5f7e922d8757858e9a326acc42e176f38c3000000000e8000000002000020000000717a3f22469b1606568321d814c7e524348fc19aa95addf03d59616092ba162790000000a226f5a6607113915ffc8b7e27da3f71dd203d20c71fc025e6448746362fa9b767349bb382a145a577978189dadc50b9ebe3c02941c4e2940e0663951d245ad703b6143ec4eaaf2f1fe788555391ec29f7f27c54667373442e18f532c5263038dc10d752e4254cc6d54b02edcb5242c1845b37f96b83f794e2b87956d96fa8353a88418629f2205c3cb1ab898b14f79c40000000ae2dcd8de8bf37bcd1c819059bc9d8dd1d6d9b6dbebaeaca05b658f6fbc2260c12c9a749ec6689284d22af78c3fade879b2f3773068247c0c37b7c5a3a3cc24b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EDDE6AE1-187A-11EF-9DC0-D20227E6D795} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2676 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2676 iexplore.exe 2676 iexplore.exe 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2676 wrote to memory of 2380 2676 iexplore.exe IEXPLORE.EXE PID 2676 wrote to memory of 2380 2676 iexplore.exe IEXPLORE.EXE PID 2676 wrote to memory of 2380 2676 iexplore.exe IEXPLORE.EXE PID 2676 wrote to memory of 2380 2676 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\688ae7d84da3460f9de4110228ef55a7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD512df17dc18e2d85b5617366edb9ff52a
SHA110f4f69ada53ca14e6ee9b37b79ec90459c4db9e
SHA256e031d5468af7042841e2eeeb57c93bfd71c3a115880babe2cc6825af831190e0
SHA512a112b18cb4cc351dab7c633af1c381404117aba2e193640c602c9999ab970f74e02440ad1195ed3cfbbe42c26db84f343115b3641ac329a210d9cf9bfb1f97d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD526864bce5835c24997ab385c1b6cf7ed
SHA1eb5da10b4e65327f41dd69d4192d5bebef240929
SHA256609dfee665015f2b8e923901d7464b8d16b7f63cd1b55ebef9f7eb8492e4c89b
SHA51227cd5b46d8a6e31f8bb00468b026a76d69b0e0d31b1ccaa15a39c9865ff044ce868f76dd4131a65ce067b19c15bc2ec3308da52f1d395c6a9076e9d650ca8eb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5bf3bebe5d893b18e2ccd189b9090dd90
SHA1b5d3592d70ebb467e9ccfd40e22c3bb431d6b312
SHA25607818450c6fd0883d3bb9d31e051882204bf247a820d14a1015d9e5659d31e2b
SHA512c3a811ea297bc22b60be0b595385623da64deb2b33826b806c445614f9df778e0ae905507b65c51b3175fdc0896283a7c9a9a5f6e8819e26fba7070b993b6f21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD504d9d6965e3cae440294eb72bd9a98b1
SHA1cd04b0dd78a097b7df2c1883b1cd659b3883555c
SHA2566a71b33b24a7c3dfb0ade8a9bcb1d6b5ce96faa01d43a5e2ab0f0493022afdd7
SHA512cdba4b239477b601abe889f9a43d070253bce723d0bb73c79ff3e49da3ee18d201cf0a8b15fc7aeb145e43c9384ca0f851910869b472e58ecb2454b07fe1ef2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD542333d9e45e5e367e4fe7e42bafcac3b
SHA140a2eb0d7d3825a3a34ea0cca4c8a736cf7c2d00
SHA256297238c5d5605332cc7aff475e40d391691c59e0fbd0fb26f070a0edc7f0478b
SHA512dc62ad65dfb351f8d4d5ea07263e50927349968cd2c82555c29aa7325d9673a66884a4db450da4e5e2e847ebb9355f58b248b6603571c703d97bdb430a7c16bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5cb280b40b0e4d4d1c59d548426a526d1
SHA1488a5c7e839a15f77391a664e6cde109721e68e3
SHA256f225193df978e50ac00f2d0e29c63dc0797358831e3e137d56e51885335ec484
SHA512850245c62b12353818d23ebf931fe25990931789699b2f50b491b36cd64761adcd14a980d67d0fe933d9439dd794c723b9b0e0562662f69c2d43438edae24079
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD56eab9a12104931bd1d511fcb6913110e
SHA1dc9eee5a75806cb585b9ff8100e7d476711ac45b
SHA2564d2e9ef66d2d236c62650fd7aa78ab3611e32c3aae4fc569db64a28d4798e19f
SHA5120644fba8a01a297a35da98f41123c8af53efa6f9444b271d1a3c0e22fedc39bc91bae6c5b720ec916ff2d07a95aaf74aa87df14e702f3be126015dc910d536a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a8dfdde9221c73d8647036c3d67873b3
SHA11c042619a17a3e9f1dbd14b6cf7b077076dc2a21
SHA256d770bc0e6904d8951af700b9f7efdb60e23aedb8b89e490638f98bcd942836ce
SHA5129737ea9673f1c87435d804a1b1e2f47df4a469498a28fd3c758ff90291892b25f5a496b622b7e22cfdc8a83144813e8df314c117eaa85a012d8286e103dd6b60
-
C:\Users\Admin\AppData\Local\Temp\Cab3813.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar39AF.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a