Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 21:27
Static task
static1
Behavioral task
behavioral1
Sample
76d581862fd8d9b64f71cf6449bb5955_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
76d581862fd8d9b64f71cf6449bb5955_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
76d581862fd8d9b64f71cf6449bb5955_JaffaCakes118.html
-
Size
16KB
-
MD5
76d581862fd8d9b64f71cf6449bb5955
-
SHA1
091d48c09b97d6438c806b66cda8ec007d65adaf
-
SHA256
979ea5b11a88659eef89773841431e70875b2f0b2dd2d1d84ebff51b6cdad98e
-
SHA512
0ebed1b6e9ccdd6a310c5e02daede94e083d95a7f27f5ffe791bb13a4e5d2f575c7cfd64961f7fecca7e59c2d8a42e0e2bc072920eee7cb3e949e0300409b8cf
-
SSDEEP
384:L99FqVaOBMl7+sPuU68f+NyDxQIFx1t0sT22V:zEVaOCXM8fmyDxQIFx1t0sT22V
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0038e39ab3afda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C610C6A1-1BA6-11EF-8E9F-FAB46556C0ED} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000004d4ee74bd3f207826d116236491a6b4ea1d16d142f2708bf7342cb484404661c000000000e8000000002000020000000e71e534444d3af2548198d3b1d959edb3bec36405653b0e02dca69c81afe73e4900000009eeda3c8b4b87b76a2680b94400fef7fde9e6aac1dcb09ca0d92c56ed838b15ad6179120469434dfd43e985144f41f9baf6c9cbf8e77516f72d0a4b53aba73bc483b97185c8f48340c90698132d16fb6fed686bce20c3cc28d651dec8a716ea70dc67e76b85e225a855c4f563b54c26488635b9af10464cf55d37333ae0a168b74e8655df1d3f5dba05dbdeabad5dbc1400000002c58d663e25ced4a2a325b17ffbcf8aab51e352a14bc0b8003325799de6c4b3a11c3b3435630c0c693f4866ff50165dbc2b86be7977ef7d7a76701cae2dcf5b3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422920724" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000f594168e2c657cf1631e5eb1f8ec2f406a3ff1a1e5b8524750291fcf2d1edd3a000000000e8000000002000020000000f13dde9075f7960744dcb0c06a3858862dbb86c001ca6c5a855e157bc2375f002000000034250d8065538a641f9eae7dcb51c31c91eb41e354cd3f43f550075dffba63524000000053277228a09ef26efd529d48fcc6a31eb5b76c63741b7704df59026b91a1157eccdc683197613b45883f2b004cc373001a1b4209227e3990507ea098ddd8ec3c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2980 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2980 iexplore.exe 2980 iexplore.exe 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2916 2980 iexplore.exe 28 PID 2980 wrote to memory of 2916 2980 iexplore.exe 28 PID 2980 wrote to memory of 2916 2980 iexplore.exe 28 PID 2980 wrote to memory of 2916 2980 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\76d581862fd8d9b64f71cf6449bb5955_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520d01fe8e47a1dff09bffebe20457b2e
SHA1cadd2cc20f831c0dda12ec44d82c5b553914910d
SHA256c0391da087dfa12e52688a96f6e84c3be727f4d4737a6ce991804502bb4efad8
SHA51265339eeefd1c06c249e8ac43501bab0be22dbb1ea3d63c954afc6e2ba66d85c60257d1fb3aca7e8c50c2cbef714cdbc22dd4a8e21aac42668d2165d2c853882d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569caa0048d7d6776297bf59f155d77f4
SHA1ab96fb6d7fbfd39d3d183a846567abda096fbdd0
SHA25631cddf448176c46c851030410f014b3d629e5ba41aa43d894d1fb933a962d855
SHA512d6f81abdea10b1608934cb26b2920eb6cec1dc1d14cd77c6d34be9b945f5e9335cc199de23c7ecd13d9a5c26e78fc740e9964750f6ccd580a342d2b3b05a746f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbb4dc10acc8d847aefc6694c3b5359d
SHA142bcadf2b4865a241b35db226e661aa3dafe7c5b
SHA256fc664d70019f9eab98366e18142f869c36e7402897a562664a9302f6c23a2323
SHA512e8bc82925901ee3ec915848a1f1bc61ac84b3ec816038aadc06013fcc00521a13c5f4a7f2e25a8b331e15b016bd628351b5a4fcfecd8adc40b10eaae69d9f418
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e59b18e71759c4b394b41e3e3330f7ac
SHA1951d176bccbb848707fcea1ba90f69be3ef5e1f4
SHA256bbcf06597ef58e176da50356b6018ca91992ecfa70a5014d10f9ba33334781cb
SHA51282bd257dffc1a250eca3da468da8958cc521bed3614a7afa90b8eb91e156b6293c3c7ad37cedb010953f50b3edf83bff4ce229888d8da160d2d56bec8be8e300
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53091a27dc25b183383ef68a8ecb9da3c
SHA1b4050444530e0d184364fdc5d752806871a0b796
SHA25607361e5556fdc1b4c3830e553cf657bdbf51c3f42b3a0e5ff4e94fdb26b17b59
SHA51212c7eab79df41b045e03461c9c907d7d297bbd5587f218c89e7ca22dbbf78069cbd5bf0e07e7ec75e9130d5c6f16b17e9ee2b2580f817cd217135321f8a88487
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5006210900ee71a657d65fde4abcf8c9e
SHA1e5d13e2df765241ab85529d2346998f3b86fa975
SHA256477f11af3adb2e75d3a44ed4a34e61e99c8523190b25effe02b1a4058f46b5ee
SHA5129810981d0c223e997ae1f4952e52b85a8c1be27bc752ed302fbfdb4fab3df4c598b57a01f3c7835c544f507bfe934aeae55bc80654d59cf069b968425620426c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f22f285be4daaf72d1c6cdf0828f0ca2
SHA1e195560a634b6d5cf244b2349669952a26f2523d
SHA256a85e5ad46335f6848efb0b223eef6c5db1134ce2e6fcf361b8a75a6a5c9a4abc
SHA512fbac99c86a12bea26d3c40e2ac4a6ebe7f254760cec57271fabecd92b7a598c460b7f535908afb429f31a30df26a6ff36a442a6ef54abf82dc3b1ddb8eede4fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e4d8f416727f991ab31d6a998d901e9
SHA12e84fb369a79ed32e1fd6a8792435219cf785e3a
SHA25620fb3bcd61284130e222672c31c62bf88eb67f7b6902e95fc087de66769bb60b
SHA5124783ddcfc83788c2e2e3ed49a6e7c2aaacd397fa0a53683310d2f780810087cadb754eaa6ef239049b97b621e4abc0d73ee0127dae06d2544195c805ddbf0d3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f841de309752ee31cf19443f0fa144fa
SHA1ec7c1efaefbabf5affb6e5973bd40564b961322e
SHA256c29d96791c2764e1efce9d1a159381c305820b17acb4d3493a410a59ddd14b5b
SHA51280f84f41006809e64e753517765952da7e2c295dbe8cd32f600796f862d7f5715ee3af803abddee1e41ce3dbd3aad2870d1c7789cd8e0b26d99c0a7bb33fe1dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5edd871e7688cfc43a7bf31d3099b0a3b
SHA11c788c745f6e90320237a23fa87204cd9667de05
SHA2568fb51701b1f10adaba5a98528a2dcb839296fa443c7942d16665d63f810bfb5f
SHA5125e4c4282d41c8ffde0a0f8d834efe9d5861e7457a6cca20c326443cad900f17801c205bd70cc7f230f29f1278790293aa33febd452af2b6aaeedcd2d67b062f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eee054924e31b25270465f1965dd295a
SHA14988735eab6df23d3b5d9844d2d9cbf83c720304
SHA256f9d883bbf5e8a7c3537b93c0d185a5b878999696184bb75cb3e9ee3b585f866e
SHA512e70acb0b5ed6e293b37a7857e05d680da7f4499a826d3f21151b9ceafb9be8bd918f42ffb9d78e2d770f44d0bfd84d2407f2205a1566f516803ed68eb8d10595
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e8aca91d02949f5d6cb110a377cf1e4
SHA176300476dd219ea2e6ba54f875dc2bc6ea9e0569
SHA256dcea46baf30508cf21c6e7e3886d5a171fc0814e728d86b9094fe7018409bde9
SHA5128388c00f593ef022006a7d12341ba17e168bba907ea0185480642853c7e649f4cc7ae454d292f1e12b8809a38fc91c22bc33d9b1159cb233535c2ce1f6655c14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502bd0e485cc834394f7fd43923ab52b3
SHA11327cf206deb301037673c56547141c961570f72
SHA256b6723103e59a3257bf715e63f9391a35b8ee77b643c8727dc20318a082060a41
SHA5121eff38cf569744fec32af2e6203b8a95ca7b50ce417d3e9294ae7914a0f6d521ac59ff9b4e493819eccc4d70236b9129681488d9af9ad6199ac9ff64058c8653
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eaa944ec1f0830b605815f573cc77201
SHA16a013ff9698696e1d3d0f59bbb87939e80d09b36
SHA256e3f3a9e899df65ec844e0688d8a88b2c76b839922b7793f827e290efbc1206a2
SHA5120b38a83e212f85bafe3a26b66420b4ff914f6bb97a768181d437a326e3805b107eb98cd1ce8a62c713858039a029bddf4239f9aa5842da62f1a212273f988cf2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5143403099418086cd647966421cbc1a1
SHA1a36af9887875ce32ba9caa6385725ddcf8d16f8c
SHA256368012ae6da8da8d33d77112d83274beb11b8611e9839859b5f3aece6c9baf06
SHA5128df28ec7d36aabf8becc29317683ce28fee77f385ced7903fb12352b8a40c76748af7851e6b27fd914518a9e85601aa1c773c8656648012b8ccd31707642a390
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d220b1bedc0a0a4b92e7231333350e17
SHA1daaaf7de5e6aba60d6fd46d57a684f90a117b18f
SHA2567017092f37d40b4bd3ccca7d07e3d807e28d529190b9ba365a7d2e1c474d3247
SHA5122dac34d171f421fe1e10679d3ff2b3ff9b01478175628ce83141da7562ca5f1ce43ebead62b6b2e8985c18609c8351ed1eb361a308774179ba88a17f2f734148
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d29984b7787d07c9406161c88a6cefb0
SHA1a7ff8f57bec44b0deeb8a339599a9d227bb50b13
SHA25600003c2f746b255e29314ec3b7e7a3b3f0b3b715ed885abcf95be4b3af56cd19
SHA5125cdc4a900645b54de9fe28ff5610623f9e46f8b8d9b3d5be9f3f577557253ae4ee16bb9c10e97b07e6da8b5c366b68277cf63349d26e692eb5a021cbb74e909b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H09CVCL3\scripts[1].js
Filesize32KB
MD5f48baec69cc4dc0852d118259eff2d56
SHA1e64c6e4423421da5b35700154810cb67160bc32b
SHA256463d99ca5448f815a05b2d946ddae9eed3e21c335c0f4cfe7a16944e3512f76c
SHA51206fdccb5d9536ab7c68355dbf49ac02ebccad5a4ea01cb62200fd67728a6d05c276403e588a5bdceacf5e671913fc65b63e8b92456ca5493dae5b5a70e4a8b37
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a