Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 00:42
Static task
static1
Behavioral task
behavioral1
Sample
73c9fa431d86fbcc649de96fbcd37980_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
73c9fa431d86fbcc649de96fbcd37980_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
73c9fa431d86fbcc649de96fbcd37980_JaffaCakes118.html
-
Size
4KB
-
MD5
73c9fa431d86fbcc649de96fbcd37980
-
SHA1
eeb641bc8ba9e581a19ab1c2f3196bc8437e7c64
-
SHA256
ad8004ac8f1998556019ceda5b458cab7ecd0cadb378b131d791b96f02af0040
-
SHA512
eef3f3d130520c22ce4cd2abdb6763d28b092a9cdd7e45a9769973633b561d3c77107cffa9e8023ca6721141ace63d4ee0ef20c606ebf712482bc098b5f894d1
-
SSDEEP
96:ou+EhMh3j7VDkuSEMtaCO+XSNPQSzmBZh5MpJ1Xp5kX:CEhMh3j7VDkuStaF+CXzmBZ3M/1XDkX
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000daf23aac58826fd1c08b19537921bef0371a0b811ef94001c93cec6d2fd8cb9a000000000e8000000002000020000000a369e8d3cf8252296163bc0c3450c65878f7dec0eb668bff66a3cc23f865bb962000000096ccc96ab38fa8e7751b89a7823b296a4b687b4becd0dc78779e01815193bd1040000000f21dccb86ab76312fe38e58a7dd2eb9b2e68aa70d6daed31dd70a5551ccd73c65861587d380badf269fabf4ac3b3c7ea462430c409ef9baa2a46c949d0cf4e66 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD7C7501-1AF8-11EF-8189-4637C9E50E53} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422846004" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20bf47d405afda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000b813ac4690eb6e09d9b8e2bfb15efc654f48d39d04c2deba26c93a63512c998e000000000e8000000002000020000000a7065f61ba4efdf20dbfd6d89dfa4da1e97d9a1c17da3c89053fa452ec3148a0900000009a851e0123f4cc482d8ca9d5c738aa511a45e6c79c783ab9d63372f48f2666d6ef230fca0142da879895cfdbfe3bed9bca73cd4f68e268d25b9abdbfa872c8214bae95318d730418939ec0b412a4ef25de52396e0f371d17ff3a7193a182813e55815d2a70dcc445f83789b82e2cb32f4b285ff7422a77b824636e45452deabe67a4a234f06ed2ac85632c9e35bfd0554000000075d5c6123979bbecf5105cce17002f0527c644f9c874e3f27de98a60dc4b87e3cac2fd0d0d43832a7006335fe566fb7bbe85889e69a9aa25f7520db80326595c iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1848 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1848 iexplore.exe 1848 iexplore.exe 2780 IEXPLORE.EXE 2780 IEXPLORE.EXE 2780 IEXPLORE.EXE 2780 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1848 wrote to memory of 2780 1848 iexplore.exe 28 PID 1848 wrote to memory of 2780 1848 iexplore.exe 28 PID 1848 wrote to memory of 2780 1848 iexplore.exe 28 PID 1848 wrote to memory of 2780 1848 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\73c9fa431d86fbcc649de96fbcd37980_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2780
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d2bb655644dfd188709928806bee44e
SHA1422bd457b6a95fc3c938732da425c42276c8c93d
SHA25608b6f09a2c3ae11f089a090f6b927c5a59bd796dba67479aa5296edd4b475d68
SHA512f1db1c5e6cf82443a680c3807b11ead17454dcfb23bcc0b2bcf10fad8b9800cf90ae1ccbb222fa34a09a4ae8e282daf1e7feb38ce0cddf4ce8aa148eee9365fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c89f065f80869deb1719fbb0d6bb5c47
SHA1d9c7377ea04b1ef17d6e55d8efc26459accd3391
SHA2569479c5edc0ea63eb3fb7a46e747a3174f843cca5403e511258e32bb178197f16
SHA512e1ee428d73b807b053ef8ee13f9ac3ec512915f2fb296a57f477537e1ce689e1843357ffeb2f6179249309b1e4f6bd161db0bbf5ca0e4680ab0a216d1cad2de6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5660000bc6834fd85d3ea8a361c99ac28
SHA1cbf0c1c0a48f6c9bfffd4f2f7cc13efa14adb23d
SHA2566694cddf4f692f08634b0732e22472873f9ca371f1f85c578d66b8b878e203cc
SHA5127ea74687fc79475ff63dee3cc952206aacb4b6b671034df00d66fae58cbc2c67fe6df3103f76eadc470a6bbb0425547b9d50b5d410f475bc217e4866b5bde3c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540ff27c88b7652821a0d1ee986ae7688
SHA1aacc2d004f5237a1b7cbacdb91b3bbe5f7548abc
SHA25614d5bc1c1d2f6635b233fd61282ce16d55f772588e2fe0db81ff263aa7c10e52
SHA512cfd2dbfe5098b4afde527c7cee5baedb13cf575072b376514bc683b09972ed7f65fa2fc9323007c77777894a4ce0300f84457af6bc0c783dd950de987194592e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55716dae440eedaccaa6d0a6ba074961e
SHA15cd33f2b703723d950e51b104621ff82e345da51
SHA256068767b328010cb1c4be2acc2840723326048c03b00fe2e741dfc3b7b5bfd601
SHA512acb5ed4f17fbdba67a8764d2258fb131ccebef08f7e88a454b5251d7f47227803c9084d34309e6d93ea9fd28995e4cd847db361abe7fa4df425a5154e8a423f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552a2f7d015a525237ba99be409890f0d
SHA10930709987dda12ce840b836e347126b49a3b684
SHA256c5dc85c43604842600bd2d8ab1446ad9fb846a5034cbba0c8d2dbda7b3d06fcf
SHA5126b4d490b41819dee04aecb21e7275baacda9ecc119e88d59dd63f41fabb684a51f5d9afeab888ebcc2e13ef054f4241d94c1d9aca025a8dbd311acc820583865
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9f78348e5f35da5971d5a6cb82007b5
SHA139a40fe8fc701ed358c608eb37c1609ed8d0a54f
SHA2567585b6da92f5f63235589e958372c448358ce133c78124e019086a30e4b8b379
SHA512ba23960338d021695aa9ea90cfcb4aadd5b162152efa4602513513cabff59636f48200637e2ad7b411facd3cb6e83248b0105f7f2c964efefc3328df87ebf1e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdb7d9b6ba544778e7758f2945b7fcb9
SHA11a6457149aa76851b46e33cc377165a2e7f1e6b5
SHA256ed4895de5b6942f2ce591724086065a2d4276bbecf70bf50b9065a017bf4e01f
SHA51247998bcc599e5e6c1cf59e65d59b815b0cfe9455ebae23e3b2416e01662e321a428666df640ca95c1a85d27d2f34bcc2a6bd869316c429e95da28fc14c2e3390
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e793982411bfb768d25843c9deb8094e
SHA14fabf9c6b7657392b2676c0f0095d5aaa6fc1f58
SHA2565d9a17fc01e8eb5267b6403fab61dddf4cba253bffb8c3a2072220e044f7b257
SHA512b24fc61384bedba2b1ae948d1219840d59101143aeb2920cf771303ff42b5cf726762f175de0e4b2feb9315f78cb12cec5c0756eea20cc75863ea01566f11573
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e2cb59fdcb020099e4fcd20abd3c222
SHA1a72d86964f984b29c49df91b9b6c80a888d1113a
SHA2569df4c620f810ca54a70a5ef6359f8cd699d301ec519380f8544da5f6145cc24f
SHA512f944a81c7bab4320b4eb112005519e153e897b3554b51224def60c152f18fd5c7d32a9c500ebbf84cbb90318d0123907ace609ce21eb750398e7a38d78de6756
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50dd4002961bb54fbcc5800a32b22cb89
SHA19be6cc465bbdd9297e692b60de5ac52690ccb6a7
SHA256f8bdb2e1783c35a113cefad7408cf70f4602f73b15b15a42c715a39b084d9160
SHA5123527401075a07d350d5eb56c63989f8ec2dcf025b82036d69f1f55b5c75c0cb46f780737f14c39afae0a2b45624219a88132df48555996e892afc71be6d51ad9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5b99530ffa0dc221dc4b5fe5546a48c
SHA1c3ab05a5c3866a760663b864f94a9eddd28819a8
SHA256597a04fe9d768bd52d64a369f993c19ecf1b9620859e37d4e3476597580aef72
SHA5125137642745d732d16bca9136dd3a56802c3d0216a00291f4a9bc45af774f43c17da57245de3ee1410b2a145088121fc71ccb32983eb657aa9068127556967087
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5630b06158fe3e18afe94f8f2d94f51de
SHA14762526ead215eca8ee3bfe180ed1fefebad504d
SHA2564b2d285067cca1697c0ab871d058cd2fdf6ba9fd725472f0fb0219a83c2bcd6b
SHA5124bbdd422cf60f02f4eaf5211c22b9de245df15cc46db03a07272affbaa85a67fad221f987c097e59552fbd5710bda08ec9078d7cfc5a6f9387b8ce3cca43ec6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa493e0fee8a5c3ed904866333f229c1
SHA111b4fea4515fcc71e844d7529474cc3d607cae4f
SHA256064a843f8efda362eb2e0f21135f044008b815d8a4af6eed15085dc6a64a20b2
SHA512799a290e44cc6d9451101f3e53c76ec4732450390e9eca02af76dfe93bec7ce465a411dd91bc30d14bd8ea683c3c93c9020587c1a4d8fe20d2c991df91b604ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd72f3da860bb284fa3bd8eabd0a6567
SHA152a3db415f46f2a4c6ad483e3534d2aae4df26b4
SHA2569783c9da4a04b69a0ec7139ba7d1540d4783682c8b1f8baa048d0530005b51c9
SHA512fe2f0d793327d0289ade00364581597371a2b546cfbafbd658e3c11fd305b861e0986146b0705e6ce9d2c010f005dd444330cb3256b2e752b139a6054efd8c3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3914893d0fde7b67d4376c56e82b599
SHA1121d8651bc99af0ccb42fd5e86b858db706dd9ea
SHA256f1b2bdf88dbdfebf77a24dccc5f4b12d877b4087e74be531913df5038f549079
SHA5129a971455ed68d4ef3ba4e7375af8a36e3bfdf682ef305367bf96baa9dc24d75421183ed8c65649321df5495d31246fed893885d3d2057aafb1a9c119e933d99b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52778a26e0f54688fb087721d7f9f98c0
SHA13e9d2cff50a0b7926143ff2dba4aaba28fe3e3d6
SHA256a4c9f7d37bfaad745ce72eda5cfa52f2171d49d278ed1b8187a679c6e64ddf8f
SHA51256be49490312b95fc4f5c432422e25d21a56d004f4137b9c9e11bb922c0a3b56c75c8121fbfdd008813d2ce6ca5aa20ece7f8e434e5a63820368c7487908061b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd3ccf90eaa46739d3d260c125e7444c
SHA14bbe9a398f4db342d56dbfc6a6b6e4b82900cec2
SHA25674732b997b60bfb8d351b4a88fdbf7523122ddae0bf2cdff408ca823d13b6dd2
SHA5120ad09934249861be3ca059dbaa516b15d249078be473d4f94b5defc147c5cb55c66c809ac6ea3f26be7c7ac8d0725e227b69d1cf421b06671cae3b6ac4fb96c3
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a