Analysis
-
max time kernel
135s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 00:43
Static task
static1
Behavioral task
behavioral1
Sample
692e3ed8ee364051ab98b3dcff488469_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
692e3ed8ee364051ab98b3dcff488469_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
692e3ed8ee364051ab98b3dcff488469_JaffaCakes118.html
-
Size
129KB
-
MD5
692e3ed8ee364051ab98b3dcff488469
-
SHA1
98f3e070f14ac25441fded6801c1479ace843f37
-
SHA256
1e3cb571e07e0423de0e5ea1cace18d2d616042353f91aea1b814ade93a3620a
-
SHA512
d5d565ec1deae21a35ca35af8ae5e78f4c29b58dd63578b5221a91db621178914c9f1f6aa13840ac313e9bb4c4ad045cd31680e4bcc5d09ffe58f6c595e490ad
-
SSDEEP
1536:SsfpbB7bZL1a9yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:SsYyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422586887" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4a218b01a9ecd498b9aff128b3a661c0000000002000000000010660000000100002000000015905d3d37fc4f12da819652170dada0ba0c2d5f5e158dbe552ee974f4e4f9e3000000000e80000000020000200000000b0378a5213b1b32526b6def653f14c996b19f426ff8ef0548e3943a5764329d20000000144c1bd483c6c4259df44695508e91e24deef7eacb0fa014bf4d1c8057ff783d4000000060df0d9fba52d1fcc8db42702270ebca5089181e08b0bd6690ce5290dbafe97d6d2b90cdebf8a6065053bf03ae2677822378f4471cc41606909de8a00a7bfc9e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10cafd53aaacda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4a218b01a9ecd498b9aff128b3a661c0000000002000000000010660000000100002000000027d8e47512b8cc42919f7e59001fcdbab59c210143e62faeaa22aea7645a05b5000000000e80000000020000200000005012ae73755e96b3eefec66737585e16f92ffd0b1e6c8c26c7b89880ca4cb78b900000000a905a6af2dda42eaf2e3f7d72256cc80504a78775252942a41ac1ae2becd95705b351a5565df06e3795a9ff5734603900e3bba029c18284c37a12da5616ab3e00aeb161b29fd24977a2dce13edee098de66d4c9cd22f806fccd3e297886ab41f54f0e9f4aeff0903a4d3c161f71a333c786529ee0f64fffdec143e7957fe567749bc36a7418d9988fa3c13e9207fc25400000008b922778e3ac56eda6fad1fe0fb478d347f512838c4509311880bf756ff213b95c53ce521d896882a78b6ed8cc2c82b80f666b60ef46a7e0f8cd4be0352d2412 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E69B661-189D-11EF-BF06-56D57A935C49} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1252 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1252 iexplore.exe 1252 iexplore.exe 1904 IEXPLORE.EXE 1904 IEXPLORE.EXE 1904 IEXPLORE.EXE 1904 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1252 wrote to memory of 1904 1252 iexplore.exe IEXPLORE.EXE PID 1252 wrote to memory of 1904 1252 iexplore.exe IEXPLORE.EXE PID 1252 wrote to memory of 1904 1252 iexplore.exe IEXPLORE.EXE PID 1252 wrote to memory of 1904 1252 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\692e3ed8ee364051ab98b3dcff488469_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a699a78df92da7ba1bc69bc57980756a
SHA19940276ed7f8e91599306a137a07adc2d1b74600
SHA256f563b82541eaecf9a04b7f48c4a1de8bb488089cb53b3adc9a12980e3aa92c44
SHA5122c3711790fdb9cdca5e60360f0145aefb4cc06e3fd17f38c0acf834b8d1150a292f26f10b0ca5f3ec4022c119fef37b01533f023577a7ba496babb549cec0ced
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD53e4100c6deeaf2146b53f2a6ac398e82
SHA1274d8fe95ae5ba7bc37088eb0ff74498fbc73113
SHA256a611088c2d1c3f273934932a7c1955a9dbbad7873ce80e262ae0cd777ee4228b
SHA5122be18345024b92f0433ddb7dd72d0da3ff1cb8d81db2cf2d20425263766a6dbd98ebd74dbe06d389b3c14723c9a6df20c37ddad40dba338492a4ae34473ab548
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ebc88814cd37bf04c53465dee4066751
SHA1de8993637cfc2ccbaa314a10e7cf30c10bc99123
SHA256f68eaabe9013346160600e2cc4c6727964b898661f21d672e4bde801e00a0fa6
SHA5127a01ea2ba384cb71e3980ee4afba9cd8be70038546c581cb8879dd1b4b1943d8d9675e65197c0f85c9f22d1fc29337c8af00756db27079a4eb110e9539e12b79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f498e715c6bcdfacba3d601d3c4b0fb8
SHA1f320dc861378edd6831d78d0ae9c4bf688644428
SHA2566a9b55ebfb3cd0448981bf80abb37375c7ee3f177f3802a66b54a6dae8387663
SHA512788d7743143fc53c07200663a9b0b5c594392f7ec7192303897840e3fc2e1e07b0132dea544df9e3b7b7521c8482425a5921f792e61a0cc45797eddb7a10256c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5fea7c1473498f829abd7d98c30bf5f67
SHA18142768372a1185ca9cf6df0eaf506910bb5be6e
SHA256c6821203cc2fe576035d2ecf98654827f5ad3c0dabc6593d82ea9f039481bfdc
SHA51265295175a0b0887031da13460d631f176731104fec3443d1285385bc70dd4084dc1a988ad41636efa13a811c686c10d3ba6d46658c94d94452c090af13e36129
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5894ae638a47797a01442ba3653715142
SHA12373d87f7724dad3f0abf8bdce20e3aa07dfcec1
SHA256af9136b8a6dd1cedf632e50ab2c276b7cd69e67d040bead67d3214f4dddec97d
SHA51239cfc4bf839f183b88169b268b515f78fb3494b9e27ca08f6f5d930785febb3898a0f62724970c5192f00444d04ecc5357bc78352db8ddabcd9eec8f810e6b45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD512fed580047b8531a48c6856207bcec3
SHA1c235e030cb637e5a193e5dd3938b9175d1dc2830
SHA2564bccd91f97f45483e5700782fc8e1a2a43167b14dbe573d5c7c5d99756f4dbb9
SHA51255209a438ea1a41de1e8ddc7ffb1c97d05bd80dce18d1299a6dbe175115ab99b0696e7f98a1096eb52fe5f21606a26380b119dd1573565c1331c85933d16b728
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5fded0df31115ce2b6882b2c2898d71df
SHA1ad8838b9345a1c551ad06505c01fd098402ec8a5
SHA2568aa55ed46e3dd2f2051e00d3ec9a37e256600cd446e1dcee73b789310c83feef
SHA512b27de75c02459fef7e78e6a4602a920e83570fac773d1a96e6b9f62d3ec96bedeb0a3b0139e9ab71d07fab36e0af8537257b93617e53df0464dae2e0bf35bf85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d096a3f9381cab6edd7ad72a0e17e7fd
SHA1ebe83fffcbb321f961478d0e8875f78c45cde27e
SHA25605a4d60158dfae0c811d2a04a1407ccc32aed4e8ee198bdf460aed69467e0db8
SHA51214edbdff7ed5c226c61c1505f6be5b9f38fb84501f0529b8f758b0f6dc2b2a868b2a2fbf47ad82838e297e50677623f7c7fdf89ad43758e9379d122987c72684
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD560cc38002b6ad48c7c5e6ef75dbad54b
SHA17d9796672386686ad2d6bff918d171c0463f4a17
SHA256e4bdd57777e7a5321e572cce429e1bf99ffa7aabe5d8d53105b14bb6bd890d02
SHA51243b0a26ee802ce2598c0ad02fb27c322557538509ab81c327f0384490b9ca9af51f53003d9f7316d03877f828dbf7ff6d194297dff591b834d430f8a31e2d280
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a095e89b50c47b28506285c980eafbde
SHA1e0cff2ce824d1a8939fb7fd313aaf02da7e375fb
SHA2563a0d258c473612e467100569ca86e2714215ea80dce09034b6817c2f2cf244a5
SHA51219ea3a49098263834c1a4b629ea9305d19ab557daeb17bb1868cb8b32e469a8ad76b47786e18ed705845502ebc3e51b7fbdb401097d6ab2149c4274523cbaa6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5394d4a89eb8166cf8fca276b00e78e89
SHA10560ca8c862fe5db6e3e2cc05b6b23bce6c47701
SHA25653b705158db0e0b1e069622e1b5f25852bc8a2c4921186452ee0d47120b0767c
SHA512b8308b9093ad5f77923641ec55d6fb2a68983a7ba40d9d78d45865788c5f27b371c20cc361cf833d6455d6415334ac7eb63081c8194bda118750a1319437df9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD591b7ca5df9fffbce17faee07e41be6c2
SHA133bec6ce07709aaea9f978e4306ff199aa7cb742
SHA256bbaaff8c72634774841ea5a54a93af3b69f17321ce9e1cf40d60cee737b24e21
SHA5129089eaea3c01c58ea89982fa1b8a2e944e7bb4738eed1d1a104b9571288dce7fce4311eba411dfd37842ead742b879ef6a8b84dbfcf5e8a065e3e6002115fbe1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5aea6241d01d639ef4aea0b60cbc95da5
SHA13843f1043622a115f455fc60fef8280d476d3c79
SHA25610c7ed54d21c412018e78442079a62b4c4c8e0d03fc3c9b4b451e140d56e71a1
SHA512b9683c750aa2483cf69a08cb37815469a798947d55a7442e7e733f75b78970157121246b925aec36f5d0c759f990f9376028acc6b83b3bc0ff462d1d57659dbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5235aeb0b878f1006d5bc5f090d02e5f6
SHA167053d35b87592341ecc5bdce499549a7b6b08db
SHA2566f346db8248d23c8603303b226580c4221a7945deef9f081c74a7f221e3a9a36
SHA5125a7c711ec8160cd46a3d59c05fe14ca2fad663e9be29d5de12c177c15d631f0cd2399b15fb59b6d86698dc555cb2c7c1a84172238985c8fdf0ead88b9127e602
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD510d9ea80b154e4ed415f1db36d0bf33c
SHA13eb27a311314cbe3545f9fe1434972982f1af30f
SHA256542827be181f1dd43f6435c996d0ba1df8fdd7fbf414b8f3a019950e87447da1
SHA51234016e574371a90c41b4227ec51a5642c6628c1121fce643e275b6198a66fe0a95891614b1c6321599c9ca5d8d27ee1fc39e75c7e661db5e2315faad4273064d
-
C:\Users\Admin\AppData\Local\Temp\Cab94D2.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar967F.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a