Analysis
-
max time kernel
118s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 20:23
Static task
static1
Behavioral task
behavioral1
Sample
7323ab508b77d8b7bd31349f4909314e_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7323ab508b77d8b7bd31349f4909314e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7323ab508b77d8b7bd31349f4909314e_JaffaCakes118.html
-
Size
9KB
-
MD5
7323ab508b77d8b7bd31349f4909314e
-
SHA1
ddaf0b8ade46bb93eba83c3b3221761ebe574a40
-
SHA256
d0184a2beae878b4561ee53f990938d8374ab3f65d4b0104c8457f1ed5ebe80f
-
SHA512
774ecc4cfb9da29e438a8120878fd63a9c7ba6682d28653fc5e1b80c3a9f9b3de319fecb5dd197609a8fd971db701bd5f4b356f98d612254d56ff9f3c51d54da
-
SSDEEP
192:SI0rIkacai+uOMWeF1d+6VqlpoAj/9zmCI:SI0EkG8t+6VqlpL1KCI
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000135d2702323ade9b4aea3c82772fda0d806b5bee78a75fb9886db677743589ab000000000e800000000200002000000007c4bafe0d0d60f92f8e534459a03ef9949f4af0f2e070f3da7e1cd5edf1aaf0200000001c4c2624c925b449ae27235227899656c032cbe58b1b27944405cffb38acb1384000000077e91fcddaf1ace77d81b417cc07e54c8e7f8ef714709584aff43bf0aa4110a531d1828a5fa20a268c1c50f3d20079a4d89ab11e3f231e17bb5f4e6045c7bc87 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6009a589e1aeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000005f04bf92245f78877d5aa519ab4a6f2277ebf72b17c95d706a959ff49e86db3a000000000e8000000002000020000000549534937425e40e09c48603869281580630ce564af21a4c4efa126603eaab1f900000008310a76ee2d3a7e3fd1264a73f576b3d3e8f2ebe227a1a8e74ecff79362f7f930778e04413e055f716f80d45f17bbffba051350910ed2e09723b6437fa5414a45ce069c8100d6b6b594e0baca6315dbbefa13d1990f668ab102a85966780b7f93fc62fad999fd545a36e4ab9a0524fca865e90ad00e55cf6b466bf726bd5556334e79588330ba5a697db2eed2f531bf040000000e4333a2b2fa54c45b4c0c4d64e099db963d044d5306b512c11110e68e1b2ee5d47f3d1437ae588509daac8cd1b2fbea85636820091d6ed5a34ff43afb40a65de iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5050241-1AD4-11EF-A7A3-7A58A1FDD547} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422830501" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1488 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1488 iexplore.exe 1488 iexplore.exe 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1488 wrote to memory of 2068 1488 iexplore.exe 28 PID 1488 wrote to memory of 2068 1488 iexplore.exe 28 PID 1488 wrote to memory of 2068 1488 iexplore.exe 28 PID 1488 wrote to memory of 2068 1488 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7323ab508b77d8b7bd31349f4909314e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1488 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b7ceacaf88b2b0da2d9dd8e8a3a7c42
SHA1d0e2b1856aa83c0bfb0a92e2d30292c001c30971
SHA256603a76b92cde7665c95d6ce34b1af8079c5570aefb0ed438dc5f5333cd58c727
SHA512af5d22db7235b80d4d4b4dc560191e8902c176ae0301d890fa17333a37c9edc6cce4e3126d7ce1c477c8484598ab4e49d3f21411e5fcbc9054d023205e924397
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f67ea80aa977ee9329180d2ac2808ce2
SHA1b686009c09653b4d943c976fbd390127f0d52b30
SHA256844a3e1268bb31db2cc9be0c2c949631c5f811da0c9dab2d93d28c1b547b01c9
SHA5126070946ebfc82294eac463034498ee23a0100228b104f884ce005591a9d877d1c271a02554d098becc2aa94813ff3abc08f5f0e9a7cd2b9d55e243ae9fad3208
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6988ab3d5d0dd0b33f8e87fb60a18fc
SHA10aff5e57b58df3337075d1073256006a4d67a968
SHA256ecc4ab61ff6413b06413e19b35aa76db28fdc8390d304c1ef5c9a5fba38d576a
SHA512811b206aad2ff1ef7f3b4f381946f28616cd3c6345e6e30f5d166cf72ea0ddfe6c6f9a97ae52f759d0bf2c45b0d152f75d3ee9c0b2c60516e2d3b00932885b82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b70102a557434053219d1d34640dd46a
SHA1130513e713c43ff94f5c0430bdfda6c13d54d37b
SHA256a6d0b7994c9f46c92dcfc69594eb5ac4ebd2ce96b03ad520bb255503a6e7272c
SHA512caacae3794cab7a31ad2a834057171282875a3eeb1125137e8aa82b1848050f10d5577920ac7f07c7331fcfa25f5b6021ef4963bfd14b0738483f7d0cf6c5ebd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9ab367d0aed6f5a81db5a367328dad9
SHA1c88549e1ab05c679a16b6ff77e2f95e854448667
SHA2565f6b8b02742ae9d23708c646d59154b4146949fac9e68fdb4bc19055465a8a75
SHA512a351e926f2a023979a419bcaa4298b0d290f0027158d9bb9c6b4d1e31c3ead26082ecd15114806ff6ac255aebc3b21927540f2ea1be4cb91006b9b0474bead6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560e57ca6802db1ce65c5e5c627a78513
SHA1af1c7a64f0971e2052ea0c3061d780ad1910a0c7
SHA25661bb1ccd057a34edd82e0001c035731aec4973ad9a0c64999f82706c49c2b9fe
SHA512697913fcfefc575e50fab94c4556fb844af7dba3cc9fe8fe344b367f75622b6aafb061c5d3b6fa5953cfd4343ac52deb7dd26ccfd42d9f0da09faee732384c9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3e4832c2482a86a01e9049b3a4855be
SHA18d2fe71cb85623fc1040da0fd19461a254831ec1
SHA256e1705bf9b5c588ef7b3707651afe79b6b31c77892535f353261bb12771927139
SHA51263e92d512cf28c6aec4589a368739decdddfffbfc50461712469c1b31497b1d8e9dc8428c4b0b1fe3839a12afb002018dbb9e7e2a7f1e0570a11ccb3edf4cba6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5578d61ec4cbd6e783dae607a3ec8019f
SHA1eb3f1415536d143beda9ef458c8021de549cd5f6
SHA2568ae5944521bb6affe29c0c64c775e46df2e0aac2e593e39f45da774307d84802
SHA51211e4c9e02306bc69c12595678d32bdb26e0d187df60f71aa21a303d99c0d1ea112c756e8d6f110386bf9b694cf3b6376d934518486c82d67fa7d4e77114589a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cfb03c3892bf191d057d377c8d61f256
SHA1c06965e453afb9b0f8b06ee9243196708068ba82
SHA256d28707e4fba9bc5d4a14939aca5801361c950c12dad7481122b4b2e0aaade453
SHA512568d1f8a25f1131578ad7bfddc4d2046c5949466b247146b71367285de86c78cf39a49a2dd7e4bc6446df7c5c3ce618f1878d79298999d7a7de65359ef9bb52f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bbd7b6c7b5b94dec91e00e5c5018500
SHA1182da65ac06a48fc9c3e85e7ae15ed49e9c775c8
SHA25686e7b5d300464b43306de3263134c07254c33ceaf10eace0ac47fece2124b472
SHA512d93230c84e2f434e5c7c696f1144df55cf6ee9cb04d0af403191a63f0f69df662e6a8ad1073f3a5fa8f70063d20dca727e7159f98ed8f7214b6970a8e0807ee2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0d6061ecc2b0d9c6d039add3c92b772
SHA158958977d8d4f5836c3822b89792649a624e773a
SHA2560b728fefd55d52d0c857d3fe45cc120910968b6d333eece6145ca00a93523a64
SHA512a86a4712cca3717b06a7ec33c870d067a7638133442c2d7b0e1f2a0a7941a196d0d314a76d5564d81082f3547b7f741e02e4e4f9697f71bfc5adb7911f1791ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504e02ff4c88278ea09945c19e18b98fd
SHA1ac7cada300ac5a94d7c22e812301d7068190c311
SHA2565612a9ad353dc265ee72d56236f8284f85de697f2a4859caf1f48855e436540b
SHA512ec94cb219802a0d76bdc19b67dd081cf5e15b5259b8df22f7ce067749ed819ab229ed8a1ea8ab705f6dc32e355eccc1e522a6e662f290c154d082de1093a6f95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50846a33b8d58f3d857f3c7997403b737
SHA1da75a57da277b21349a01f3673b6c1d255f614ef
SHA2568fd5c0287896ec8bf3ef7866c9710d8ba25083325d807516ce0f393820db376c
SHA51255dfab035b8f5cd9f6fc818b2321cb376389d75cc93d864ccd1afb66c9faed35460c218a4d9aa187d5fb0c6ef207acba2ca4e474df9d7774ccbca63459e3970f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc1cec37b7ab685feaba0ba8857c074c
SHA18d276fb8a4c74bf5a20b41db38353f3692032691
SHA256aa92a9bca79d19e6360eb77d64c7f2dbb125b9daaa971334598e3f16f685312a
SHA512714920fe80e4bd102a07db958d6445f65611bfd9b4624a6ccc594718745cc95a5ce2624cf7b4619350847bfa67695fecd7d3a99e90d33c4683abc79dc9a778e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b506219c5c37424fe95345fa6ae3a048
SHA1ac6c7babfb34328f0d4b44076e6aea402eca2d3a
SHA256465dc44948bf1ef8d91accd0bad826108ca328c73976d39e69a59154067ca17e
SHA512bc67a2b80011397afb7d1f3f5af456ddc5741e538df430a4385b61158e2603fce0e4ad1457d6516af3f3ddd12b764d5765cd9acc78ececa30cacfed7b3a4707d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577dd184a557a16b474285ce7ad299546
SHA1d717bbf73bc253a22f4458cdd6ecc588598365a9
SHA256a4c7c0ad84894f9b19cd3e1f421c09707080931076c2724a0641765ea0223106
SHA512457ec5993e2e8ad498da0d98699675e82fa3449a2c64129215a6dc69b77bd2e321f05a943021c2a9a681642435c83934e8009bbdbd523072ea724423add88e5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5006f945dbe130cf63948703aba6a7b0c
SHA18c25f98869dc933ac0e834db0224b7ccc364e625
SHA256592c33adb3e19cb30082308cc02b7b97897a90e4c5a2b25ea7b632e2e85a93d7
SHA512ac356f2637f43dc2a220496552598ddc9e45f33f9dfbbea27824189f04c9d03e8088916a6e058570ce33efa04074dbc30588de9920ecbc687aea3a67af8d5e46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e20b6a30222d4d6671895d738a252696
SHA188c9e5f5872ea48643973f649ed67a71e2cabd9e
SHA2566eb64078ae2a87ef966f436b70ae22250d382d4b00327a843bddc29ed33318aa
SHA5121617fd62f461b1bc581ded5d149cf0a21c24431e8a082fd9cb3713681af5f32a0866a64aedc020fd47737e08cbe09fd9380e112bf7acf30c4ccbaf416169c0a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5543360ed027e835aa6516836c67325a8
SHA198a29f7b34a7098458cf53b5f38e06b94f6a14e6
SHA256c57149cb618c39b3a4981d8dade56975189a92244c8b1c0e3045c79457860a92
SHA512ab2d0e0b2d1bd821bcb6b464540c9bc1b897b5aa574d91b50474b476ba0df66ebc2ce97b75be1beb3e3db1fe450a20828106a4e59c42fba53c3d32b17e838462
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a