Analysis
-
max time kernel
143s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 20:45
Static task
static1
Behavioral task
behavioral1
Sample
68928d01884253cf014f279ffc9172fe_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
68928d01884253cf014f279ffc9172fe_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
68928d01884253cf014f279ffc9172fe_JaffaCakes118.html
-
Size
460KB
-
MD5
68928d01884253cf014f279ffc9172fe
-
SHA1
e1b4afb1b610079de566e59dc12412218bda27d3
-
SHA256
619b1feb819bf997921b09c20c2c27abcf885b32c7ceae9991060ca9f4a2beee
-
SHA512
2375a3bfc8b31bd86055d50033b3ab98777875124fdf74ea9637d76adc0dd65bef0b76cbae7245de897ebb7bb32ecbefc349bcea552dbccff5f8e46cda22f184
-
SSDEEP
6144:SbsMYod+X3oI+YgsMYod+X3oI+YPhsMYod+X3oI+YLsMYod+X3oI+YQ:65d+X3g5d+X3n5d+X315d+X3+
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e092db1c89acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000be56a7416ff34989a3881a8f57e27c34952285033112c9727c74136d4ddb599a000000000e800000000200002000000000798a885b30baef4e297abcc2fa966f3038b280e1b2f1bee837cc005f88feaf900000007547a5f400d97f8edef1ba9bd70c9cdb88a0126cb3cae799181d621e2199e87b11fb1369039b6a50a2475e67c818d245079884d169e165cdc21b62567f3ffda26b935416de21c9e147d92e35bd38fbf9b74c39e964908b7b8897c73dc77b6f3ed9d7cbe059c2038e80f240b0321f2ef0fa791b4a660684c1f50abaca7b2b8cc9d0f1e5e793a0a663df3cf36c2841af2d400000003d9339bc0235da3ae554197b13edc2e7e4a34dba343a2eef3cab3f8c2ee3d6860d810ab20b9ae2b854ea43d5da6eb6ffe73a0b4dad5e91e6852b71b6e3bae93d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422572624" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000009b9d6fe61b056275e05295c2ed07362f68261119a1bc9b2a235117177b0d313d000000000e8000000002000020000000729fd20c1728abf6d708b249d28942d7f3cd82cccc894e7f664db4ff238d187b20000000615591912007b12d37283b2272bbf8b593660c39cc9600532bdcd08da2a5468340000000197edfa21986e4bf73b952d47d8d8e8576a08705ff78b122c00ace7d0c55386df781a322af66c310559cf837d1f1850871ccf1a5db0a9d1f5032ebe871813e90 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4452A161-187C-11EF-A5B4-4205ACB4EED4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2040 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2040 iexplore.exe 2040 iexplore.exe 2460 IEXPLORE.EXE 2460 IEXPLORE.EXE 2460 IEXPLORE.EXE 2460 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2040 wrote to memory of 2460 2040 iexplore.exe IEXPLORE.EXE PID 2040 wrote to memory of 2460 2040 iexplore.exe IEXPLORE.EXE PID 2040 wrote to memory of 2460 2040 iexplore.exe IEXPLORE.EXE PID 2040 wrote to memory of 2460 2040 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68928d01884253cf014f279ffc9172fe_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2460
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5226ec5cba19d10d64a0ea80a0d81d4bb
SHA1548b8fe06626689b5b258c19429decc0ee12d01e
SHA256fa3589f958fa76fec81247e427df0c800e33448273377e57ea7439abde14dd66
SHA512497d5881ae23dda7dd143374109ecda9215e7f1bb284ff083ab8cfff89ccf8ac93e2dad1b1db791ea05bae03294a55de2a8826b8982cd723a14891c73e9f3134
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590f375df560c643a0d2d0eaaf2555e82
SHA1fa4b0537c23a94c2a015f39cc8f88a15919b2920
SHA2562a3af3bd72ab1bca981b39f08397abb9a5387ad8f4f196b29204d5a3a55d31b8
SHA51225b494f932c9963f67a9ae833f30fe4319fc0d6038899aa9a455143a2d5d19a8c288c71e135f06375b1a6977232bea61597863c9670a899d807f02d674769f3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5055d7ac45bae6dc40d86aa7f208c3c10
SHA149e3977a822ef8e9a3259886bc93d5c922e58c49
SHA256d7bd803044fc35076a3f117602e1759bd3150a9cc62ce3f81d6956a8efa8d382
SHA51219771293dc2015c8685383bd9f68ef5e9e3a324086ba5a00ab0b1a3e21ba56ae562cc900d02c0f3b91fa8d2d7b745c4e127ecf4f765392616788ecd89379f8e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5079d4cb08a0a3067ccef5f52c604f8fb
SHA1856b3521bd81bc449f4570725e3d5623b223811d
SHA256b79d05b36381b308e6e63c1c08d6c65bc6b217dd01acecec5f38a9c4b928ee60
SHA5127c218f1006ca4eb8f5e8ae0c703a4360f0974b6de4666116a4c99b25351d5cfb19ba1c80da528c324076626a2f5694b45cb79fa2ab35a5739e6217157b355c9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f737b22e2c4a1be4ae0e3fc1028929a7
SHA1f0c8bf83ba48c985289280d03654443e38484176
SHA256c3064be85adcad333bbea13b58e59b1a91e7e76bdb13d77082f00abfb9d2fcff
SHA5122998d1cb5863da7c119d1fa566ce072d95c129c4f83dd030e08355e1a5d39e14e88b8710e3ae46e4c820608d07ee90d9f9bdb0acf56ad2ce9baa23956e041195
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2ee98ac42e92fa22ba7f01df3205a16
SHA1113d6672636a8cecfcdb6aa17af30f0e3b53c6a0
SHA25671592c684f38a4379e349ff75f49f08eecd3fed38b2686c5b37dc34d806dea8a
SHA512fd48c14fa6e9c01dc09539f1793b73601149bab10a636119069380779d14659cc979fcd8367ce7a3452367d60fcfff29c6ac66922e856eb7a1525a31c16dd524
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545d18b805d01ac8c16a886c88c77d086
SHA1eaf9a2e6aea193bd2e82cbd80d78856dfa554fa3
SHA256785c624d27225c83576895043bc3dcbabf42d747cd6b97c6a178b94385147df5
SHA5120004c9b4be3d7c0ba48b270626c9dda204d0c6cdfa41f5be873b132eddc50113fb7c1d930e419a10f4646b2279c9052c01c78447a6ef7aa2aebdf21810c7461c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf627dc63330f3a6fa14b9be51c93a1e
SHA1e4fbac39a331cdcc1c64e8db349a33f6a1e34dba
SHA256a7fd34b81652ed51385251c4f229c3d90ec3d38e94f2cf0288b1a6173c2dae93
SHA512b8cd7fb9c7aa132dfd70cb107f60dee7cba4e4a5cba4cd57064099f6b8603f7886f363c259e5fa78eedd221fb74458b6b7ef2e3944ab77325fd760af8d18c1c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57dc1d64c8a21b9a2e93d19d18e764d8a
SHA1aa61008fae28bb98b76b408f80c7398f2218baf8
SHA256c54d487aaf0cf3e58a96b6e0db87ab1efaa3ffd1d82dea101a3ea4d172cda923
SHA5125d045f3300f8c4f40f1309753b869814e0a7a971a300ae31968323fe418ef4d6a5e4babfc269a903e8eabdf28aa1a709f2fb806577168d87360cbdeef4db7996
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ced1eea08ed4062a891e0a14e4db96ce
SHA1539e9655796ef9bdc92f151bde36c6147ad8e7cc
SHA25604c9658e1f5aeb2a8befe9fc7072df645d25762619c2a91a30455c147e25b8a0
SHA5121b77189183f872781708d0d1c428e94ba657ba3b459543ae846620823a5e642c1df432a28e6d83faf4a3ea34afe7c5bf11ded90c3aa6ef4d0edbb4394660e7a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5630e6cb2831cee66982e21baf87eb0c8
SHA197e8c654ccb04f9499dbb3814b5540ed7b8d68d5
SHA256169ea93670cfb2fb5bc488a67093dba501ffd90c7600d5f3fa0b60bc21b3c37a
SHA512c446e32413525d6a979e5894549d9e2a12cfceae4905d971ced70361d720fc14514c5c57b5175025c7c008c504ed721ddd67776501776600c39d543994f2a816
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d642dba8b5836c228b926789fbbaa508
SHA14eff82ae4b5fb984da96880f4815bf69668c3220
SHA2567501ae10d702a0ddca20e119397df6a42042d161aaf44eb72c9cd2f489e0daef
SHA5129150f4f9fb6a3ba71e0474795277604359b68ebc96bbcd1f1322cfd05219bc569756f099e1e58ff2938ca79f6bb47cd52fa4168c7b28e2a112b6ae182b6b53bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fe817d40158cd10652009fe5d4dca24
SHA1b36062dc3de9ed02fbce6fad7a51bbbb22bacfe8
SHA25608770ade9d0da4f723d2abd8c0f185ed9082a89473d377d92f0db7a43fbb5932
SHA512a1eb8e17e62542862c25243d546c870c76bf300659fcb29b8585749966a48c7afcd94a127ff84908d0663349d23bbd1356fb30b6a8a14f78adf9d74ae06739e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558275c77e106ebf011903104c22feb59
SHA10040d2c105278a824883c217600d361ab71c1af0
SHA25619a2b4823e2d048e14dcbd229ff65c49760e26bf4ed7aaf786f26f711968d507
SHA512ef2caf751c4b3151a5b7d7cc1be035331e16f3ab8ce4b27540ef57ff09471328427ba4068822026d886a2c9afa198ff707c5f0243b34f9c2256d8a39c5db31b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505bbc9aa22bf2d254f358466b7526e35
SHA1b3eb6f65dd7c3cb365c0b3f0ab15dc4430ee1fad
SHA256f33e34c306e91cc6bd19b181d80e8f6afa060b0b42bbc731af236664a7e770c4
SHA512bc0013956f13dcdbbce42fee9ccf9f878271f71dff844b282c5bb8839e4a1b30df69efbf57c333ba0f79e0df2e740e572636b8d089c37b92d1bb99d501e48030
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523b003a06cf851da4a7789d21fef3bf4
SHA1ada3df76f86e04c4664ffe78d3ad2f44925951c8
SHA256e3016bfaf02d9906572c46ed99f68f8c77f0eb317e7e7eef4b99b4e19ac2afa8
SHA5123f683dfef73b48773d8f1a44d54f133101e6a585d58d1140432aa0b7d73202ee97537eafbbd489ddb387f6d12dbed4da7b2b9db7549917c5d84a5d52987b2a9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536ce22666b426ac3c62ce87655523680
SHA185ff9a64cb2644ff5712088eeb31b83f657ca61e
SHA2562d4d665bdb59a5223f0abd49168a73adfe73a82069563f0f08d0eeeef9f48fa1
SHA51210f06d6cf7b9b570d5d0a93c3a20fcbf65f184e8cfa08ec8343a5dd6e69c6bbb1dc40209cdba3bf80549deb0e18faee10815f273a38840579178178ae2a7a65d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587c7c049e4304c7e8673d42b7ab74757
SHA13f74ffbc80afe4ed4f3f6efc46378aa24cb7c8df
SHA25677199986411d4777db7351c92073fa8a31679646b2e4ef84570df1b3f63bef26
SHA51228da4dcef35bcd19d59ac876f96667a623049b5cb4eaf24d1d9971f84694615fa10a2afcfabf8c80d78b8b43183979ca54a675553e87c99444b161deb5c74cab
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a