Analysis
-
max time kernel
118s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 04:47
Static task
static1
Behavioral task
behavioral1
Sample
745dbe2408618212a9ca773f8e9d80fe_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
745dbe2408618212a9ca773f8e9d80fe_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
745dbe2408618212a9ca773f8e9d80fe_JaffaCakes118.html
-
Size
37KB
-
MD5
745dbe2408618212a9ca773f8e9d80fe
-
SHA1
941170fb4644236920e7b3e884c4346dd0ff9be4
-
SHA256
7fc8283d07dd61ac46584da9017ccaa0b1dd65b8f7122b0efef1c726558dc1b1
-
SHA512
629ff51912a9d8713d1c65627dce2f04f63cfaa529435e371baf8a44124b24a92a70fe79d0a17c5f9f30c43192db4e7c8e854dbe7f94021cfae268ac47a798b5
-
SSDEEP
384:4dJ3ed60/eSRjsc0bB3I8IncsMTKmCMzzj:9602WMecH
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b672fef374d2af4789dab549546beb16000000000200000000001066000000010000200000001fc7874d43412c2749183cb00f51bce027a0984b9df6a6053624527ded9642e0000000000e80000000020000200000001617609bb12086caf5fe808d473fc7e20a8979c2d65cd422d494a674978cc4f920000000a20811bdae1678bd07ada4a627b27ed331e981bb7e9dbd7a505cdbbaf916981d4000000056bcdd3a4a87f695f04d433d4268df6d1f43bd5fcb85c810dc0ef7c8e0b973bd9259fab4a1f003d19bc11a9969cba0fec5aa5802e608e0b4d3a5962001289212 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14871A01-1B1B-11EF-93E2-EEF45767FDFF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422860727" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 300fd30228afda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b672fef374d2af4789dab549546beb1600000000020000000000106600000001000020000000aafc6734c2e57e61c37df77146cf8bacb0653782357d05fe3441070028755615000000000e80000000020000200000003dac4731bedd3a947e6fa14f3dc1880b7b3060df4164eaa75024f90b7e89347a90000000ef69278a5d098e48c90b2b37ab7c9fc6b3564421cbf018100497989804e7d68a2f2e915ba753e1b992bc134d574c04945a44dffc0d69dab94d9b0776efa3c3474e778a2073b3bb41ce2b0b1bd610bb1980a40d4fbc5403a98db5c063f3435670185cbee167e02e0ee679676a04e8f30249137cd34d3d48aa886a807f66c2e3c67ff257d6b48a583a55f2a9de6402c2ec4000000051b5caeb463eb9b36e2b6f4a47476b89ae3294374d1d504c3a5679c458c04137e214159884fc2737b08e5a24d28294ec3429900fa84af69f928fb6759e46bbda iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2664 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2664 iexplore.exe 2664 iexplore.exe 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2664 wrote to memory of 2440 2664 iexplore.exe 28 PID 2664 wrote to memory of 2440 2664 iexplore.exe 28 PID 2664 wrote to memory of 2440 2664 iexplore.exe 28 PID 2664 wrote to memory of 2440 2664 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\745dbe2408618212a9ca773f8e9d80fe_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2440
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aad309ccf2706a9436d260f5d048b11d
SHA1f04e93fd51827bec77562dd42d8e513e092395bf
SHA256948d543351b04287f6eb4e65c7ab8efbfd96b1e3b544e9b0a4a6676c772ed1fb
SHA512cf1c80e95f658d3388fb4081a08dabe3d3a8ab5e4b3161feb86f4989a850ad7b66e3828efc59911bc7911c36293530ab5ba12e24bc0020c4536f9ea5fe368652
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58aefd04afbd03ad82449e43c3a857b29
SHA1de7dad51d4ac55bd1c869f3f47018864be67e763
SHA25626ca319cae64278f2a98fb3fa390eb1278a02364fa9fffa2a9b52408746492e1
SHA51220e9b677c2911f28f5a25100ef76111fa20a8d203e792a189f23f14d9a871aa4bff7896f5abe170cdb315b5e4d34efe1d7c82dcc666af6f181a0b399f6db33f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555f2c58ddabf40f211171dd90020603d
SHA1d5ee15dacefc4b4479c2619535af9914f1eabdd9
SHA256082d4322012661fd5c2af861196246e548d20c75dd2ce9e756ab5d85985e273e
SHA512c602c8665253b175d1e39793c45f626e5cfd501c9b80e54167655743b83dca739491828ddcb04cc226bb2a8a42b85e215c5c62b627d3cf941d65ec894f060db9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593658588d469a5d4d64d5bfede59b974
SHA1fce6f8260c060d6b170e958e15f7c9b72342a0f6
SHA2566b65399ab6ea72d8537044a6410a1cd949ff2e46feb4551d6d92de8d55ff3541
SHA512ab1286944ce5610c0771398705d79f32945e40cbdd379bae1516f194ad4729897eb349a80ce84b144c3bd4b4cb0165153e3f9cf246daee56675b3a45b2038607
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5228c8a2208deb95c937de250106b1ee1
SHA1acef121a5cbcda644859c983f8df12d8c4f97983
SHA256f72271eb68b439c466dadeed4870fe121c62f147d88599c57831f452e79ee0f0
SHA51244ee8dcb4eebc3ecefbe8ea22f47d6e3c1af3f9d2e34bd6d8e26ec0655fa1996fd5c6d7c8d2c34f3fed657e80fe4476955dbf248cab349d8757127ab8d9e59d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d0d2de158084b98bc9dbcdcb39331db
SHA12c8c3ee1ec65550e6a56faaadf306fa381e4084e
SHA2568497c49575463f98e1000c206aa4ebf0cbefb22d148636f8494af029a1208b8c
SHA5124c545688a1c415c0f1a4c588687fa84e338f6887393f43a32c133f3462cb6692ccd16fa033aef13410a7588667d38ee55fa4a1b682fb37440e42e0bcc944bff9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aac428fd500fe28dd241696d5169d9c6
SHA15210fa6ae3a4d04b679520b6124b180fd8ea42ef
SHA2564119c541b98137108f3ef2b0b8bfeb01ca21a8ec2384f00990154ba953a870b2
SHA5121b26be74a0a301095d273ad561dd0a7adef6d2e6dd5ae33db7f784c14a3f87f1e4550c17a7aaa424ec5dc86b9b771c0ac66f4955c8cd1c25f1a3537cc7e6dc2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9905dd15772ee1d1b41f577850f6d83
SHA15434879be9f63607eba393bc6a17adb3384102b9
SHA2565288e094b640556d53912cf1ce86cccf1376fdc1e2f01ea1c9b4844091c19d24
SHA5127a79f88746e52be90ce80529827c46e0f7d5c14095cbbea689d2be721be8d46e657c0da0bec7442129cd4e001bbacb491326f947969fa253fef4a1720dd30bb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef819d85f0b7a1f8d241ae556f853660
SHA1f3104b3a5d987acbc189e2f2a3a7b3f7e33b230f
SHA256b06cf4ef5e6b9dc4615f3bd978c45dab82de0ac3e06d1b6c7ef907e5354defba
SHA5126d7d75fba88caa6b6c9ce8bd188d10fe75d3d2079008350df9acf2450dad2059e04fdd89b3a0b0f26af02eab25d69f985b293a19a4f6395dcafd633110e2b852
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e1ac064a899dfb9d8cbf233ea858776
SHA15be94c39fd1db28b3fdd6899945c7ff44b101fe3
SHA256be21d3653637d34b3ca608c54c3f4daac33061b45ecd85d1592368304351c64c
SHA5124f1c3817fefc776617f31e5a51f2c801511afeeb622576072d1651510136f41d8d7d56a10345d837fca192f548130895e800c10c2c4a12f496fda3e336ebb635
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5143f4ebd3c209879459c2dd34b62ee2e
SHA12e28719c16683dbf9c88a51e590acffd64ffc50d
SHA256a6d651ccd9689605f00fc5672196c405064ef3e226ef57c2ebb289172352b92b
SHA512dd46022b5b5da64f3727f820c54c18f134820bf76b187ab71a5c793af49f1cdea3217f02aba0dd27874a996d3473692fe16df99a69e6f73f7902f795ab75e7bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575b624b13cbdd89cca1ca17d8060058f
SHA16ba36ab1f451eff0d024c6107409195f27ac9e41
SHA25624cf9e0ac5a6a7c2ba5d1e0911df05f65d6c51186fd785d58a67f8ffac66cbd3
SHA5128283d0bc592328e1895a45175329037da4e0e486336489580be91f2f758233e45bbfd92cee9447f85caa83729edcdbf3fc5a40b834abdfca7f21c589ba0cd36b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a845a4ac04128325be4bbd30ab680b2
SHA10db9c5efc1ca3ba9483cc0b5af6b31ee797baec6
SHA256ee739e52638b520e6e1d25b2387be86934a8a91356c9dd2f1b6af98380b6e657
SHA51215e2f651d78c0d204be6d7cd3e5508c02d941d76ccee0381772a9890c35d1a82e4d483287621f6a6f774b292ae030bff0ca4e098e4633b04ad48c18f1ff0b655
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572bd5d0c85ab34a5c0b056dbcb42f927
SHA1bda8392bcb0680a3bf19d9c626e5734b5efda0da
SHA25654e517d08c1923e90a69f77d4e5cf3436b6e34b58415b9e689a1f7ed348a4cea
SHA512f7d00b67a7502b7cc5b3eb3b561b452623289749b7307cc21a7374804c94c36c73786a881de8ba750673d2b1517c5200b722350c92d714692a2adfc4786276dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5adcd2cf5f83f398676856ec0cdfd56c0
SHA1848892d5c158e796ae1186dcdb9274c090c6244a
SHA25692ba9070ba155b65eb4c5428dd644cbc0b3231eee95dddf0aef3ec34363b0e56
SHA5120c377b842ba889f7402bf2e8c0ee4867dab175aa85575f633808a8431b286e65f90bc5a33bcb798a8ed660cfecdc76116c84d378835a1c85f70520fc0abef1b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da45cb25a37219c0e301cf6b277a7655
SHA1e0e0b83f692a64c05bed39e5bb03ed139599dc7d
SHA256f2c1e0fa24a09b62ad3db6c9892e9fec793e653dd208a61ddbe2a7b667fa80c4
SHA51258e0995bc8ec0329a09e81a61aaac89f36292000f8fe48256246f79d0298ff3c34823408ae1868e8c05ba3e4a7cbc4770378b9e708c86262586839fd88de2820
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c31d95512ca9740ebe341649b3e2638
SHA143619fc157cc10ea003d4e47ee7e9d071f20e1cc
SHA2568ea1e9980e72bb7bf7cfa6165622a42327c19e910cbcae12a9561f7173f70445
SHA5120e06754a616ba07f6a65b4564ae6dd3054bd5fa9eb8597e3e3ef65c5fe079bd00303f36e55899775028beecd269f42fc637b5f0f443855cd8e165c93b36d27c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef1117c902a2c80a02ae565baf077201
SHA1a115315e88a9538725250743e36c0d95bcfe3088
SHA2568939d1c6bb18ed4583d5fa75c6089a90ac5905ca5878a2807a907ace8921ee62
SHA512e38935a4065d592d5be70b2135c0b5a7a611859e9195d69962790c33850638082a466c5505962261ae8264d38db8dd2da5b124fe20daf5eb3b7bf04a3c835463
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a