Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 04:06
Static task
static1
Behavioral task
behavioral1
Sample
69ae56b4481b979db1a45caee8f73ffe_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
69ae56b4481b979db1a45caee8f73ffe_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
69ae56b4481b979db1a45caee8f73ffe_JaffaCakes118.html
-
Size
461KB
-
MD5
69ae56b4481b979db1a45caee8f73ffe
-
SHA1
165af6fd2719a47aa57c261fa59a7879ba156123
-
SHA256
9ab3822dfcfc060957a1c283e96d7fdd22dd18e6b8e28f589c6010977e1d73a5
-
SHA512
a118bc76077f3bf4878dfe34f1b91713490d54ac5cc83a127ca90abe494169cb7aad95aefdfdeb5c0349e4c7f46142cd0ed1be25c7cd8e7c4e6ed3a4a83dc218
-
SSDEEP
6144:SjosMYod+X3oI+YMMsMYod+X3oI+YbsMYod+X3oI+YLsMYod+X3oI+YQ:C25d+X3y65d+X3V5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E511AD21-18B9-11EF-A57D-4637C9E50E53} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000329be3b8311b271fc6435011ef6e86caefe00fd8f81934f5d415decd155a90d5000000000e8000000002000020000000df75bb47998545e06668f8c9ea7dbc20a53f4003cc6b84ed003876d2181be2f520000000314770b2ec0ea2fbe26a928397ece8a5ecf90efadb722601717af658f2af2c574000000013628569d938c6c2f3df276ac9d7f84d94ef4964d3d5e3a23ef7ec6efc15202cea6122c59ccfa0c062c53f186748ad0231c4ff9588e14771184e42157daf9de2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80efbebdc6acda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422599083" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000455956b664fad6e2efe6a7f4fb9f5d3f84a72138a61e646d9c3a07b513c60616000000000e8000000002000020000000d8873924bc49e1ecd7e42978a9d2b2a3cdccec2b41bfb4126aee723232b372bd900000007ff1fbc09140680a2ac7de3cf820820159d4faa1075cb53986ef25bc7a1b76342054290b9c517a03d7484e0cd8a0f49bdce7199ffdd214db364dbf8df69e8540a26efc67c01cba4cf0ed476ee88d7a0b0cf72af0026470aab4b0e90b041e366215441e8dea5d5b66f4b87ba3bea1d2bd7f12b8ee003b2170c01186647a54019c5960a12539666ede48d9e420451a55124000000080d7a5d0f36609b0504d23dcb4a334bba5da1895f69b940e90c3f6dce870a9174dbba18dd3b32355345a321bae65493c0ff2ffddd4f2da7ec90ee3f1d8150a81 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1196 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1196 iexplore.exe 1196 iexplore.exe 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1196 wrote to memory of 2772 1196 iexplore.exe 28 PID 1196 wrote to memory of 2772 1196 iexplore.exe 28 PID 1196 wrote to memory of 2772 1196 iexplore.exe 28 PID 1196 wrote to memory of 2772 1196 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69ae56b4481b979db1a45caee8f73ffe_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1196 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2772
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2734a32a30a7aeaa35a9236e26511cd
SHA1a7d289f6eb48d374c08f39ee91f108022065bef5
SHA256759d15f954c84bcd47bc4c48ceae8717fd601613f27a02294333f8ecb202cf39
SHA512149e0992d761edcd37400c03aa67d37230d0425ea23fa5c3adb87644beb536478462fd73f81c88be5f7dd008d43ab35c8cfd6480aaede711823f922d9291f041
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c2584843ee6611750254ba023e3bcb2
SHA1ce579ee64fa7a997f678e3207686e9832c5e5722
SHA25649a7872862219c669329d97c39da2ec01de99bf0424684d3e40b8562cea7b070
SHA5122dc5d2ecf4bd80e3ab2e1cfd9cbeeab400b0cf7063cde58f00906bdbafdd9135c3b4b6363119cea7207380a01617957577a17f6d662404a8e6b69cae3f2b1b68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf993b9781a81a26402ca70bcf2ec76f
SHA1cedd4954943ff76fd5a950593685edb0d4eb8dcb
SHA2565e028cbc874ab1f12784b23fd8314c9a65a9734ea46e9f667f5d2133c5208f54
SHA512521652d5131b67501dca987c7396f2645c86912561e33cc5a54b12fa1d05fd7dcf1e297979b086f129d2ba2e714c665e66a7ab9c078f9f975a0895528ee83b6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5428ff97bcb72cfab0135e8395cd320e3
SHA1518cc6e601f1d4eab6c6bb0420590aba3dd04db4
SHA2564bb0114ad59f2c3da2a625d0f7443997b5a9b3523e11e8b36ec5eacf78bf3cb4
SHA512a4297f4317e63a25837d0ac693e3a95ae79bfa7ca8c2cb2384c6ca0df26406f79b6d6b6b58852b3fe88ad0c047b7e1a9c448135b9257f2ff2ab1c78bf209db6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5998b4726abfe0c68c91b74d3d57d5211
SHA14059637e787cd5c8bf807c4cb10f4be27829a6d9
SHA256713248ee07bbd4db368a4f409381749ea6d9d8c02a7e8e8fdfc3c5bd977c47a4
SHA512959043e0c810a504cb286231da4edb4a0fd6e8f2c0d27b937e8877c2a6056124f1ca547eef5826d1fce993e7c0280435b89ac00398fee4fe50761db6b2a30fda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582218ffae8838b84d8c1db2b1ad27c5e
SHA13edc1f3741a2dd2717ebec26de6a64f81e3ef451
SHA256237b6b0384e36316ee446736a6d3fa3bb9dc24f5417990d0a8452471a2ee2b65
SHA5124eaf30abc9e318b2e58efdcdea303226fa7ff49b2b68904770f28f2b22d65181c9f0a5c5b55080d2499c4dbae5b097a2154c172e880ab5f53ac8f11dd9fd4de8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7493a9df95abcc6b40fc5f0e6ff3455
SHA1fa5e79e1f3ec5d9bb730b9ced0a364f381196192
SHA256a3707c13b46c11fa32a7c25988f5d1d485573f0c82ae0cf1a0ad620612ee0679
SHA51240c2f4965ce747d50ce84e2681ebe6260819e894ab83e68d6055cf1d183388e57023273981c427005d0ca24b3372a813429294916ca0036ec83a2adb90b5cd0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572c77aff8389386d3c2a3747081b0090
SHA118aca1fb603f3584699f865eee95daf0cd9c054a
SHA2563d3cc06440d578b0b4e1097404187db50ecfdd8043ecc4d398782732324b25fc
SHA51289ae980987a5507e8800cce43ada1dece7b330ced1ff0177e37413023103434fbfda20490855cd154a1e53c79afda27ca27e5bf9ba3a7c85004db20a45325492
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5662dd004446596bfbf8dbe03eaefe6c0
SHA10ab7351fbf751dc543ad9a827329f5385858684f
SHA256415fe101603cb34e22840f38292cd23be12b50b74fd23a89d302e447bd30ca62
SHA51212b5b264dcd10ccffae237ab652fe74dd104ade29d51ad7ee0a3db539aed4eb5f49f8023eb93aafafef5cd0153be38f4dac5b9116132adc97ddead6d2c633879
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a99cbc048dcf2aafef2335b3f8371887
SHA1160b0bac4c425f83bb36d12724ae9a64048183e3
SHA25682df1de76c7276473cc5ca4510ceaa8e4c454a4396991ebe773c80c5a12141d5
SHA5125e9da21797279eacdfd0fa4a018c196701cae3c355b92091a8b741508a90c5c7b20f5ebaf3a3ee5b3bd1a123ed2ba253eee5e2b3218f01094063a86701e58cc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55093218d7421506478570518d423ccab
SHA1d171681350a2b0daaf57c5cfe1b8a0e57e01b8cc
SHA256a85dd182198675e1d608f665c670ca1f469fea380aed8c7d9aa076496ab5175a
SHA5128dd7ace78babae07246d9ca9cec44ac88f224765e792b807094a0215a81d81c506a12a1a70a5e6f18eaedc7694be380ad7c3ad0c105902001696931d2b0a09f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7464269d94129a84a16768e2cdc369f
SHA1544861ebdf9361972667757214ff469f281b4395
SHA256494db84f42e483c3054728006e32455dcd0424bb1b50591f4c06e79b72f7eefa
SHA5120465ba2a8c3cd196f4c0313bd6e6e9d737f300c8b873b98bd2c8808990906be77aea7d7fca23b7dfe600ac8ab6ae5ade09d6f7298a1ec1bba0a99c9619200e26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5128ae97af6aaaff50d180a3fff2739bd
SHA1bd9f8731c419195f963be58913c6c2529dc51c72
SHA25638a366b14cd199f5e04f9713e14b980c2a61188a7ed3be447fdda3f07b6cb92e
SHA512a3b3f476b1dd1814520082e1eebb678c0380f9881b7636a700152ea05f90f480bce394f11bbb2dc9338d7c9ba66dfa38179f0942238fea36df729b473f801887
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ffe20564379f57e297939c718e25cea4
SHA1ef1824979b7ca179ee402f5e8c3046533a629494
SHA25655cdf9de67a6b052b189c09e88eb203748fb8d4f3bb115d9711abeb83a256aa3
SHA51223e81ffcaab4a28158d478cc19ef2cd0910eaddda0a33cfcd70c71a7391fdbe30c41a3f89d84613b0cda656521db7ea54b56242691d9417fb0c240b9cbcac604
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5315829f4b69e5325f40da53e586399df
SHA1da6356c436c368e6471922161f5515a338272565
SHA256fa65921e0f901d81142b0ab319aec99b228cdb74d955359e67ea1b55057958be
SHA51215a6aacd1f8b95fa1e250cd3cb45502ef05a93b1c5bb9325c771dbc3145fa9630f6047919309f9d4cea43f1d2123f4d58799bb33fea70271797d639e5ab175be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5600000e2f6ecb8585b45de8ea595fd11
SHA10d6fd431c9447fd7e39d08d031eaf2794c6bc892
SHA25686da0337c6aab35c7e72f9cdc91bccba49c7610f3ae3a4d0faf981817f756a8a
SHA512e3d512cb1ddc7201af22fc349fcc26c016984d6cdf7bf2a8bcbf553980ffb6698848b73ac75973ce491ad4e24b8a12097cf9a9f3893c99748fc83400000d24f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fd89f09ea645d59f82c2772c1aa656e
SHA1a612583dcddfefcb5c35bc5ae52bd80078957992
SHA25688a8b289cca7216b79f1c58a53dc7ccc16d7cb372f2c807cc1dd114fe8a612db
SHA5124a941fe60db5206ac1b23031c98512533d9bcdf76a97fe0acff994044e722b8da9e2d60bee5cc49407cbd9d161019e4ef62b0f4bc57ee5ada7a62d52dcf9f60e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51995d5a7caa2d6eee689cb665df5622b
SHA1ce831d76be27a64c0a8a87ca5e9c2f6eaf996aa9
SHA25601e4f302d9ea486ed7f9a25c45ee6f00466eb2dad3bdd32c3b2eb7c5a977d915
SHA5120e8c24691b1c4629488d176d996dd77c7f081e0cc96b4f382fe7caa69522f560055338444b1e973e100f53a33b526742fda8cdd612b8cbc3d2cd9dbe84cc4267
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a