Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:12
Static task
static1
Behavioral task
behavioral1
Sample
693fe77075e149aa0ddcc6e1c88808f3_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
693fe77075e149aa0ddcc6e1c88808f3_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
693fe77075e149aa0ddcc6e1c88808f3_JaffaCakes118.html
-
Size
69KB
-
MD5
693fe77075e149aa0ddcc6e1c88808f3
-
SHA1
e7acf57269d2a95100c12bc93426b704c89df551
-
SHA256
0ebf94e88379e0eca8daafd86afb1451653c3fde7a1b8d0e51e53492ffe99c62
-
SHA512
9cdb94fd6248c68736bb382754c3ca019111d6647bd12cc940c409919351b7d98a337c1a91465fba9fbe6074f68bd28f56b6282e0380d254db5bf3c06256aa02
-
SSDEEP
768:JiZbgcMWR3sI2PDDnd0g6kzS/m5/oTye1wCZkoTyMdtbBnfBgN8/lboiGhcRoQFA:JdfSO5gTvNen0tbrga90hcJNnspv
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008f42c048e1e5334dbd5c924b9708deab00000000020000000000106600000001000020000000db7e2259702c016baed053457cad097c2552f4577d7866202dc3ac0201a7d4b4000000000e8000000002000020000000befb34f52ff95c1012d9aed80c6aeeeee8b6d4a4685a07fe9d51cfb983589d2a900000002a347ccbb58df79be3a07ff8f4289d547c8cc965809d99fcd77f2161b6d63b497a92d4b215ea47b4bbb3228d73decf36d25399e1e030131e5164ea44ff9bb52ebe9c89d8642cce7f307b588676c7c3647aaab5ddf637492870a5cbde9f9be248b644614baa87b700f5e8d3540ecf4e4e09f6ca81484d808ccf6541dec4b5f081d7a7e277ac6e51cf1dc4c303d5e9310a4000000069e7078ab88f7b1d3407705542bc1dcc5582182c8a22a286330702cb199e1698464a7b2a60557d785388f95a745f6f19a6499253b2bf539c81c44d2f982e2c45 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{788C1B81-18A1-11EF-BB01-66D147C423DC} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c1324daeacda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008f42c048e1e5334dbd5c924b9708deab000000000200000000001066000000010000200000007315d61598a292a457f88b581f75f9e86abacff5b6c98808eba81740cbadec7a000000000e80000000020000200000004410675d6a0ae2c7f497daf58f79bd172e9a98f40b8c513bbb0393e2490d2ce520000000bfa757fc23faeb9dea5d9019572e656bc2d14ffe0c34af781bb0493892bc3ec540000000a8c83a3b78c3531d26b8747b12547f4b8bb5d936b804298b30793131a15cc9122b83a054b5359996220564d43b5810568f66fc5e4ca1fc1da4962f23f8febb2a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422588594" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1688 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1688 iexplore.exe 1688 iexplore.exe 2212 IEXPLORE.EXE 2212 IEXPLORE.EXE 2212 IEXPLORE.EXE 2212 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1688 wrote to memory of 2212 1688 iexplore.exe IEXPLORE.EXE PID 1688 wrote to memory of 2212 1688 iexplore.exe IEXPLORE.EXE PID 1688 wrote to memory of 2212 1688 iexplore.exe IEXPLORE.EXE PID 1688 wrote to memory of 2212 1688 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\693fe77075e149aa0ddcc6e1c88808f3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5efc1d0862556fc36770fa84d362bef4a
SHA1a873b1b179ed77d37fe8c3c10d055883b06318a2
SHA256ee50ea4b42e940fe172e2c2f6ff36c8be3f9c6ab95400d5ddbab6f5931177c41
SHA5121617923efdab25360cf135c2d04446100effb030336cbc7014af3a378561009a9a0a5889d30ccf6066235cd4272a294970b34e794d6c33abdcb7abcbcde0082f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD55ad4460cc294e10f2eb6df8ecdc900c2
SHA1e2eb782d9992c2b1816823945c4cfd41e932df7d
SHA2569712230b256cea3ecb394a2bff0f3c78e647cf8e431855e600ab42cce1fe41d5
SHA5121399ca2d5cd0c0e1b1f6d22ddb6b77de1896cb22865b865de1bc8fdc02c7eca5d2ea881eda3ddc64737fc87513771b551ec7d6e07663e4a0f7f8ada0ee32c030
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e7ecb7629ad90605975c0a198b0072fb
SHA16da11ca6c45cc92ba02158b3a208518853e80f60
SHA2561b1027a3477de5df5c8979e99b727ed020d9e152325a95ef9d8104ec27be587c
SHA5125c06d496ca6ad0d60864af2d703091d9ecb4fd08f5be161a763a7548f7c7d87ceb389775fef5dcc6d100ff765954accf27814aaa9cee47ace8e92c4fabcc239a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c0967d6687dc0f4ea24dc434bda0c95a
SHA13609fbb3f7402a3694ad149832a499e89b2ef4d5
SHA2567fd5bd14947f3253413e119e20e21680cb4304cdc7109db2bc47a726d9ff0f63
SHA512675f75c8772b4a9966070fb899bd1ea48bdbb637bfeb83069125cfaa181328cccdf5ede39cb92f344ff111ea4db1afaf84c2a7b6d56e8b52f2bfb4ae75a3943c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5abb82c69a0d9cc6f94ad065539d9547f
SHA11b378ee2449903200ceee38bbb8e3a553dc8cb2f
SHA2568cea1e5140a7b31f9e8de311b9834a30f76447354c4f2bc324cf5deb07ef516d
SHA512fa0f088086b38458c31634932f83078fad709a2a5bea647dcf74c52a879ea9fbe2907cbc9b6e10db5944325de48bf2c8920e18e9fa3ff43bfb6f13e5652f39a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5fb5ddc515780536c09ddaa68dab8ebe5
SHA17b0f9a9ded603f2f6fa078fb080ea44ef735a193
SHA256db1c396cf66de025ca1a701a72275a25dcf5253074f5a02eaa1320c57ecc22f5
SHA512e645ea8b5f9f6cb586692b1a4e194daa18904fc49c4de3f2cbdc710250bc8b73326f76b19e68b105de1e26e82c372f4e557079903555c37fa1f93e7e8d0c5b06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51155e9ac461845ce8878ad4f9fd074fc
SHA1b5a5df6ede25db5f00a666036f19cb7754f650a6
SHA2568ca0ad5cf9777a99480b7cadfe0b272b148494e78ff6a9a432ddb2163169b10f
SHA512262f507350d72ff0e74fcf0430ac89f396c90eb546e74caf6df195f0d1d3b62195da909498b62e67c7dfe27708fa7fe78b72b050cd79888e4ddfcda689fdd716
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54e4a39e3aadab680ac49efcabbaa145e
SHA1c3dda96a995409b6d0ed25922ca0663b55b91283
SHA2564adaafad5f7d0734a14b1edda438aec15598bcc5a029b1575720404b4a262f5a
SHA512968c1dbf97de405711a00623c60e1b207e2d30d16cb925f6a209df353e2a58e77663f973d7ab35aae6cc5d3219d26f01b333c16ce5f6172364d9785b0073a199
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e43cc07b1135b64cbf5e3c915d83a772
SHA1e3f74dd12356f769bdd08f7d2d19156238c12d6f
SHA25604bb25d1a0a0a3e9ad612845e89c0f6622d4d708cb0b6052f2f859b3571a9364
SHA512711b66fff83c6cb674b5d633358b6fa5da7d771c582b811a945f5e9e6094cd6fc9a8a769432b6fb249e1422f0e4a99a0de1ca6c81b6f3e8be3c7ad8681798be6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD534bf54891193a8b6d88fb55bff3528ba
SHA17317596888787f8cb0ff56078a6a605ea0c3a962
SHA25646254864bee5166ca3e88ce2c95353a65d2c77199048e43f67f5e42705a28efb
SHA512c35b17b10a8177dc99dfe73983f9ffe20adf8a2484ce209e5236ef5fd6ce2f5e513bd6cacf8ae084dc90fd0644417e104e510190e3e5dedbd9621283cb37ef62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5041d28fa909f70c5897e9c4ae39ac891
SHA19b839a5be5c3ef0f133cf3256ed699bbac254efe
SHA2561ca8b9bfb30ecff959053363b89b969682559a97eda3332bffcad70ee1dddd6b
SHA5120b58447ba438ae5fabd7188bc80cf2630f3531992317da614619ff53b2d8b1617d1eadb9190c39b922cbfe0e77eff39b98fa86cf24f8bd4e858939fa81857b3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD55aaef1dc494aef1e4e33d0347c4e8070
SHA1ec97dc5fafbd50e40d01b5ec0402df8c26c88439
SHA256534b7a8681a47b43f58a09ab1bdbda2ddb37af895b09732a3132f198497f1525
SHA512c5894a1eee5d1357e07a80dabfb5e92300c8afb73e9914ab4de11023b81c01ea950be3656135cbf17b8f02ed8d6447644b6be7b92e3eaae4d56512e616909a42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5adece990d039bfea211e9ab5e7c13b72
SHA1410d76ca95a6154fbfc1ec27c0547959ca0beec6
SHA256d933c456d024a339fe194dbf24104062909b63699631f6d45dd87930de41f915
SHA512c9f0d3e78959ac4bb15740e6edda8b0ed9180871c490da63eb70c9b4f0495bc1ad0c8f5d5d0748dab0d1c602d6d55c3589fa5ef81531b2816e85dc38765304f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ac4ef814055ad772e10ba496853d9e3b
SHA1fbae833b0e13df52230d521fb6850eaa41ac6e3e
SHA256a7ffd91490ec70fa9a0393a98f63f3a9ac450a77832ad5b4c817efc12099c370
SHA512824e116d3e7003ec52b93496a84b4f290ea0afbc966323afb6a77e9e62cf56a9fd98e70f051f7099f805027226092bcda2a581d53eda3774804348b3058f9097
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ea2b4413f72b6dd157018add7055b0e3
SHA1ff72d502d20a7124416b8d3670ac69aeb2fe3e71
SHA256a45cd0ce91187a395364b8620598ea18bc52d9b0d2f7456d4b91a1e7eaee0a6b
SHA512aaa2594314cd17a593be32a1b1a33c4edb66bae3d03cd4b81b791d5e25145438ddc345068d9be4161cbfa8b909802f9997a613bcfba7681620f7722937d8907f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5829e21782b7cb9d89576326c24a76f57
SHA16bb66aa2490cb71e52d1f7f045b336135f709fdf
SHA25635707ca7abc702bfd021b469ac2af9ffdb2205e48839b8290bec4db3508eebbe
SHA512d6bbcff09bf01175a2ab0d68d7387a2c712ca819bd9615a99b201030a3b22ef646e6e1851cf31e41d3f5fafeecca5c53f62aaad9071978e14cbcbedf0f856322
-
C:\Users\Admin\AppData\Local\Temp\Cab2964.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar2A55.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a