Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 06:07
Static task
static1
Behavioral task
behavioral1
Sample
748bc5ef44ea6df301ada309a2b7024b_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
748bc5ef44ea6df301ada309a2b7024b_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
748bc5ef44ea6df301ada309a2b7024b_JaffaCakes118.html
-
Size
460KB
-
MD5
748bc5ef44ea6df301ada309a2b7024b
-
SHA1
8e3cc8769bb4f268da26795b92857c6c06e22b44
-
SHA256
9cd0f627429026fb99b23d524093ddd90ba8935ba180e14459986a3437c237b4
-
SHA512
727239b290b68be2d8da72f25095c5b8180694d166ad13271d01edf000d5817f8498e0d546dc3e205a849091eeb02c96dc035f17041965d9e92de45dec909e3d
-
SSDEEP
6144:SFsMYod+X3oI+YDQqsMYod+X3oI+Y/sMYod+X3oI+YLsMYod+X3oI+YQ:I5d+X3p5d+X3B5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d6082533afda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f13d8afd5943cd41b171ceacfa14aad200000000020000000000106600000001000020000000850e2845cb3a65561f85a69a94cdeddfaba926505d3e28b698baff765af2a138000000000e80000000020000200000006c83f0729f0c4af3c97e5f267381153295ccecea1620766afaf54c8d205bd4bb20000000323f064161fc4e8b024de1ce8d5fdf03a44956cac5b09d0192729ae9cef76bd840000000b0107f25f7d82af8b9ef9cd228324cc7fb8cac2827203629d9e84e712d3e564cf39f487162e4fe96bf90efe2b00e6daca050709a9cf73e91f5a53f7b0b96ce33 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422865545" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4C3AECA1-1B26-11EF-9988-CEEE273A2359} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f13d8afd5943cd41b171ceacfa14aad2000000000200000000001066000000010000200000005d8da9f15617e99a7990d248e4a1ca69b4b2e47153695feae60e6a8ef168a8b8000000000e800000000200002000000092dfd7b4fc207f6981d91cfef109a2688e24078e86fc86539deb6655bb3e7178900000004cde0d9d4d8ee489aee839a8713dfa7d558be3c2406ade4521e1e705be982e36f99dde8acecf1f0e2fa89bc492238092d6e2b642fb3c7ece3f2404a22a8ccc86492c40f76b41f4d0607ff3bf5be391066c916675bd38de9048004a9e079c930dabb90dc204f67742f413f2613b34ad090eb838395bc6706d717bcdcb136e3da4cb8b0eb48d7e37f68cf550792891d2024000000075a4fc1809e465ba25281748c7c2bf4292378f985efec7fa9aad37bce1e8ff1c367b11c299a1a8045c27e5e0babc347461a6470d0e7b8d392cb7d82618eec042 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 996 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 996 iexplore.exe 996 iexplore.exe 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 996 wrote to memory of 2532 996 iexplore.exe 28 PID 996 wrote to memory of 2532 996 iexplore.exe 28 PID 996 wrote to memory of 2532 996 iexplore.exe 28 PID 996 wrote to memory of 2532 996 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\748bc5ef44ea6df301ada309a2b7024b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2532
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5123b6efc2ba5818887475af990297dc8
SHA128a633f5047babb6d4925d45718b6316e8c25624
SHA256480771d9483a571ded4ceca5a307f3c37760b3cbd5e4719521092144f6d961fb
SHA5127072f9b612f1c2502d79d5aff5537d35ab62dd82005c7a2e18350f4c46091ca5eaeb413602dc337aedca370c48b5e4e630f0178960b2ccaf3a37fc44286b0679
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5478f8dead35e3ea8f54b190bf44f546c
SHA153b154a6b7a2b1076616e563d3b6f70969814b06
SHA256850b019fb16bbf9cc9da578458403f54518ab6b942ee8e296cff5ed289687625
SHA512dda274d4d9ee9649c3e00f5e2fafee80d44d61518e577f7f7de8fcd417f25b37f091c3f7a1576446b308a4446c483814f9a6e8f6247e42bdd1166d6b0b102744
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516c751cdf9bbc9a0406386e5dfcaa22d
SHA1b9c61ef94e95d4d02da1d2a72002eef18984743b
SHA25667f8b8456f7577b1f23ca568e268faa887335264e1c37afd2abb6eea6398730d
SHA512dafc1d1fe7cd74f5d778f0f610cc5d9c9dd9426a863aa655ed993f6cda887b675279300973adb4f53b8c246e9c360aed7258c7c838778e66c9b180a5edc02f42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc7efbec9e1b932946137cbe66700852
SHA14aa8bc079ee5376a8de74df23caf639fcf034480
SHA25644e8eae592ef82544f931a49b474d032144f78986c41a9b22b3f3d47d5fccdb0
SHA5126d00f1432c965c5c4da5567ccab224bc292f40f288dba4e4f97050191c6c76e186a4ba1d3725de49395583d28c7fa2dd4bf660b4bdc2cbeef5ae3e4a5d2f9240
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2f337bd7063a055d56f1b7bf4a986a0
SHA12a6634556861b257887295ef1f1621fab0215d31
SHA25645759a5ea02b427095e1c68c0563140b8dde6183b876676c50247d9d80183746
SHA512e86e59a05eb8d572b0b1a53e1a8c64f9cb7128e5e648ae2e8fa1e5e4558196bf509620c2e9e597d2b8e5de3884e31a5ed19079dfc0dbe52091db79972aec6057
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556a1eb50acd6b5a033a0a1f7f35a112d
SHA15c3bca6522f5fe474a97047b7236b79cb2740bf8
SHA25620403bb520adb286f1bfdb5ef7a3e8a6c38b0405f0802b8d10f693414f03b601
SHA512e3ac2486144534a3a8acce230d198c8f311527f506a23230161239aa3f21bea1e8483112ac0fc5609f52d4877c28210b9a8860f95ecc8ae9ea53b3e9d0a0946a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b830b4e2f35c304cebbab0c40ed821f8
SHA1fd8602394235b3dc0ae307f645a87e908a991cc6
SHA256390c32de21007e92f2bccfdac18343fd968c9b7dd1a106c95c889d7ae34d310f
SHA512f2bbb600d2af5b50a7973bbbb9c5d55cddcc83eb50ffec74fa0bd2ded6d2f0c19dd82e9d9da221c800753284d46dda4a72df41d7b7ffdb9f4c8212282553fcd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf6a517929d0ec8decc01d49460a5947
SHA1124e4789e841d345b10abce6a6062a523abffb64
SHA2568ec4258c5c3f6d83c74e3702105052cd1a9c6ccbe23108952763424d4f677617
SHA5129c4b55ffb9e288395c1c5accd2f5842ed32821c3449436bde3a3eff40050ea2819e65292bf7d17f1bc5059b827d307ef4850487db6645eb814d8a4d297902e20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5345cdb8aa511a01291444378d6f87720
SHA13ad7de9d217ebe9da1bab489ab5391c1a25895ef
SHA256c964e8e9ae00b5369c34eca318d607b42b391231b37af0ffcc3b28949164cab3
SHA5122ae5a2893b6b02da34b8cdc328f5e37a979f35fde40885d8a662257c202189278946f946b3f0911b59dd92d1b1da055fdf053cd63dec0e562344315dfcfd72e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54503031428d244e1d8e2a65ddbe0dba7
SHA12cd513a4b02f74967c5d2644874eab82248378ff
SHA25631f6b68212c1fcd94fdb65bad3784a904da6ae60d6cba805ba61cd8ae5b3c684
SHA5128e03429aa77a6cced0693624ed064b262138b1a659162c9a6a191ab0c6e06b453b0544ed40aa79c6c2d9da152884c51e9c193f6699c5ffd2503a71c880af0b99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d87d86a030083b9c5a5110e3df261d4f
SHA1f2a58e4a706e036b498256e46ec7692d3c1a1839
SHA2568301c529633a9f2fb22b0e879dc473b219ee3891bc756fdaf4c715c7cb100b1f
SHA512ab60c6064e882911346c4fca39030d942384e835ac509f2a26719e766bf0b9b5a277a5f1f62ac76c8075867de3e641bb34fa954197c8bc4bb45bb9f422ec9db3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a56aa237a9b2f0f6c631f4f23fe4388
SHA1ad0d8e13b117437e5bd0c62e88207f07208f1a5e
SHA256a76243b35301e988f39682dee08863a7bbbf6123b82ec345277a4e0a33753d7a
SHA5124442d87e4a88ef40199ae56bf4fe1fbd2de97cb3c79f3baf88a97b2d47e4fe957f7d5d48dc1dbdc5ae6bf6b1ef51b5cbef8b8b2c4d712d8d50c19d9a86e0c6ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c877d327f411afe645aee7146212d5b
SHA1483d692080af0c6ca5e1000a6962c86cadc15322
SHA25694df4fe28a68f65fec829d2810e4ef1e019dc5014976e3e73dda0d38f7ff657f
SHA51206c44a2cf981a8f81bbfbe5eb8934945c3b55c914fdd7ce2f42a656beb441ff9a6ca5e9ada290351cb37dc6e85af7262f25fe84951b618655784d15ed082bf56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54afb9408a9ec4c8342c16eae90fd9028
SHA114c07861bd49abdda80978875a3218c77047f4b6
SHA256328a43554b678528a6cc6ae3faf4c7ec259d2ccf65e83854515965720c44807b
SHA512c20c823f120422ec0d0371284930078483aa6a22e58c33286452407d4e60f3394641c31aaf7cb761fac2c2b8bed6769489b49fbab4475b50536c183955bd4e07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5859ad26031659b2f74db2401bf9612f3
SHA12090ffe1f574b1c415f7e67ad28e3e56c811912e
SHA25616988ad494ec1f5268872cd20951cb0c7bb3a22df5dc3f20f34dc33346f6599a
SHA5127a9920a60bd9cc34a4c3da7148699bf23d47bd244d7162cf57a58f97a8dbdf5de51f3e264e2ea1dc2f61ba36cc6697e08d82c6a9313bac772e11b7b68b5dbc03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e30176b31daa9796ea867a4e2465faa
SHA13138c02ed5256a965061db29fb53739105b61fea
SHA2565f19867064821d5560436a6b5340b8071557eeebfde7b16b917454b29205faee
SHA5122cd9974a09889c82714cdcb99e6f5bfeb3e3641ce317d17ce8f0a5e7a7ba7f146c19089200e71bb80ada0f786eeaf59722d1c22c3b6cb5a56df4ce97c8a0c28b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3fa6b50ff00f064a6d02b03edbe53a0
SHA1db98d22b183876b2015b0d930af87285b772d677
SHA2564f5fc011c66088f64183f6b7a9f42a400287c9d0d777f393fae67d123110f3bd
SHA5122fd347e5b9e688373c0756bea695d6c32517ea077338f0ceb89143af37e8cb4c83e39f6ddc5abcbb326ab340d3a1f453097887767939a03cf063366462021f11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59fa8b22fc689d9cf4c3823195025f31f
SHA110325bea5ceaa1037ea84a912a4f37f9e678a1e5
SHA256e0cf06d7bb5230fe89d8a76861dc4e18e8932dcd91cc982848921856c9aa7910
SHA5127c4aece09db8269e3ee74cbcfc6a2e6499e9c29bf11cc1abaf42fdca6732b33c1c19b6e511c53e85d3e33bfd285ca46bee8e696eed55ff9ddcf21efd8c203245
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a