Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 06:48
Static task
static1
Behavioral task
behavioral1
Sample
74a5bc354615f909340bf0bd4f5b4947_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
74a5bc354615f909340bf0bd4f5b4947_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
74a5bc354615f909340bf0bd4f5b4947_JaffaCakes118.html
-
Size
30KB
-
MD5
74a5bc354615f909340bf0bd4f5b4947
-
SHA1
e1490304ac1a475d96b419fb6e73a36e0955966a
-
SHA256
44e27a9dc6bfb207196c5e6486cf7ae8408917ce3a4a8bb27b9c30917d68a405
-
SHA512
a1ad42850bb93a822c3d1e02187ebd9d9731fdf41e1e869b7554f82617b3596416ed2c97631413da0ffac8f39650f28a3cbd4489d07ffd350af893aadc4880eb
-
SSDEEP
768:B6Ljd3/VfOuIuxPdpRC70m3lZX1ZrlsbvYo5cH/GUCHeN:wIErc70m37vpvRN
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000d22a257750391d7571f99c89be8cc9383f947fc41e0cde9fcca53cc0f33fe14b000000000e800000000200002000000080eebc55846d60a2d0af1ebf30f2ccff8dede2b92f9ec430227fc6fa9c5958bb90000000f4592582bc09ef5ea9c05c5bd72faca6dbf70179e976fa9841113545da6d65ac11fc8113b388485eb4bbd8f0a47b81780000e6b6bcd15f5342f0dccc713d666b692c5277a6607d13e5d37d72f50666e5df1d7df890c3213e79298c2681134ac94096347d05d9e91878a72d12f487e7ceabaab9c8a8463d8b3087672b37f7537305cd137da58ad7fdc6f3b3a88d05f3b9400000003945cba2be2c4a8849beac7bbdcdf70da3c88dc446d4d4da95d68e721633ade86f5d0efc8b5480aafbc36ab1d7bab2729cf8b7c86b6dda87387d5dc4a26a60a3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{02EC43E1-1B2C-11EF-99B2-4A4123AE786E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000b8c3ee85789e1808dc9fae3a07685a7e398615e03591f4531fcdcf5839a5b9e4000000000e8000000002000020000000fa712dd9a00fc5f88e4f5924ec60e989949d015b8fc5b9d2c114ce33f16c06ec200000006006625fa976d01a6d6effefd3ebe3302f923673715897e7f2215557cff421d2400000009c19aab1658bc0221025f4a9900f706a7336d5c65239196a3a3c3e4ac5df6a09cb722cd14616a567ea6dc95ef0e837245ae075ca5d78e7b741337bf3688d214c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0126dd738afda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422867998" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1992 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1992 iexplore.exe 1992 iexplore.exe 2160 IEXPLORE.EXE 2160 IEXPLORE.EXE 2160 IEXPLORE.EXE 2160 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2160 1992 iexplore.exe 28 PID 1992 wrote to memory of 2160 1992 iexplore.exe 28 PID 1992 wrote to memory of 2160 1992 iexplore.exe 28 PID 1992 wrote to memory of 2160 1992 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\74a5bc354615f909340bf0bd4f5b4947_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2160
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e07b9905ce92387ace837084b7c61a6
SHA1a4a85a3947ecfe5ba16f963e97ec8a22e28ab7fb
SHA25688cb4d00328e229d96248264bd4b4f58a4541ad44a1ca474970f161875bbc28a
SHA5121eed619f2ba04474298a0ded7fac3305282e61c033e10f18e048cbf42653d4af187b3dca4ce75c8b617fd82b0df63d9e16988265a64f1d9e09bd4cc5888d475a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53cd5ce9381932eaba31c3bf7a411dffb
SHA17f6d728d3253154e78efb6560ba9e1d2b3df1f18
SHA2567272fbf6afa4b12117437359146f870f1ff11883f0a32a05c4292df25b03862d
SHA512141c275cb8bc141768fe51429a50ee234bb56ec500550f7ba5131f707bff6b49fa21280c7c245f353522fad0ebf61fe63a7b970d03c7db1913786f979043e557
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a72ba752e1491729dc26653f06036026
SHA1ea5be246d7b60de45e0b90e61f47421e9bd97b49
SHA256f98991f641f599e5ce6488accc9c79969ee8c2b269d972521059aceb72bda9da
SHA5125b741529f8ec7329276b8d12b2be0a63d474eac2e2a5c69ce309c2dd143f14c4563c47582b1754df12769290c896f4221b326f79e7e218d1e2e89367e731d893
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b025aca7cf81f0d305cc79b45f1472b3
SHA159ab7f8e5bcd9ad4d0c70dfc6a578a0d4e60c39c
SHA256afc5ade3a0acc30a997c7982ee8da7c3cf5afa1df5ee880dd497c34fec117c83
SHA51287acbb3adebb8b49afc813c3f1b9ac8b699ed39cb8d363078172df33e64b6f277f967aa2b5d4679f11d719ff41c4886445dc0962cd73d71233d4c2803cc6acc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b4241722737ddef0895c69388946f61
SHA1d21b71aa4f5b269f97f77c641b466b4c92272441
SHA256395583ea0593db04c8df5ac4f8d6a556e00d84970ce474e49bc98e19ef1ddc0f
SHA512d48a1c87ebcc2aec1db0ed7ef321f763c1452f2194c2c7fc58af0f8648f678a541e50ae3e3b887e2ea494d032f48d195b933996c6dce50e49d40500e4e828d8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5504f9d8e044f7ebef0b958103d6e3f9b
SHA15e96492e2aaa81d774f0c006890c94d76c950afa
SHA256fabfd955ab0a0b34c9239eaffcd749949c84d00d89041172ef78cda4b5115b8e
SHA512da91ca560ea3fbf64f5a26b5849c144d0569f4925e4ebee15899007992f3667bcebbbcaa3f9bd17bc7c1575e0669613fdc7a549b49ed537223cb813d949ae2d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f9aca5aaa179deb9f9306094b3d1c13
SHA16b875ebfb38b130cde7104e5861a59f914b88a79
SHA256e7846cda1b1c6cc475952ca316be4f736dc56a9b003ed3e1eeb4a3f458363ccd
SHA512686eb0c32ee6f2aed317928530077aeb3102d8a9317b0288ac5a153afb12ca031b1b35e779813b3d6b5ece08037ff47c515f6e3beefc616f131ce2a3619746b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57130d94954ad5e7c39e876fdd4bdeacf
SHA17577ddc03ddb8943326529d67cc40f2d2df18f35
SHA2561b20f0fcdfd0f32188012980568824c3a994777997d952ee7245801d08224356
SHA512166582627e334e148ffe6fc1848e64bba051781dd750e6c62163120b2af0468e39d1f8218d0ddb8eb88e43a292cfe64a009bfd843eb81cd81ec92305c04d2d63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58fe2374047911158276fc99bdad926aa
SHA160fc23f12855f69312baea652a0d5f2928335386
SHA25686f61fee6fe628ab95c243308790a68093b9c25a02adbcc0a5a80cd5bfd2f569
SHA512604de9212775fcb8f72e7ac880a2e78316704b9db8a51f42e4b5f42851cacef3bb888e498e865ad14de944c50800ae261b05e3b04039e04dd628cf06a3d76643
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a71d8bf8ecd9a3275decb3c0274171cb
SHA1ac72f171346fd72d9103f8125955f40d327ec5e7
SHA256489f48e5d56e3d614d8f42cfb29b1815b0ae0ad6c0567de8f7aaff79543082a0
SHA5125bd630e25348e1460a20ee92db354fd7a1ffbf263fcc523d0c17a77a9904bd45077cb0d9f3d21085b7fd7f3f86dad98e6cb603eba0a0ed734009a9498faafe29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a10719faf5865d7e647677ed70c5279
SHA1cd74c26082bf969bbfd1635050d1c7da15062e71
SHA256e09563df1e609c69be954dae69af6803bd83c9e9049fcab3acefee5ae7394929
SHA5128cc06251985606d03457b893a8aef04129ec7dcba4f36098c65cb47551c2c54d1daafe0fc61e949a609adcc405538202f903dab85d196a7cab6b60bc4c196e70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7c73e30b04383f2311f3ac60ff63dc3
SHA111317922fa21f45db22b47b48bd320028dadea55
SHA2567151df55021977da82c32190fc2d88ff8a25603a3d571ce927ccc339a170153f
SHA512e8803e2d5a439d7ce99b8248a463ea3270f136a6965bea507fda3c3a708e7655d7858e238b7373e3cd10210de9f8c4e8f7aa89363d058a0f6ba7083772435889
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e30d0992295956eb587c9502f911ddd8
SHA1047edd23b13f724599ed74c9ff944241f263548b
SHA256c725d90c54fa064d009ae74efcb8489e02db1e17c6d546b100ccc4dbbe10a36b
SHA512a49132a71e02ccfe213817431aab8d59f41cac302a7a32b027a60b34e9bd45062ac85e80c46984f9b4489ac42ea68beee21c2ca878b2a2b19b6530703bddda7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51dece5deec7efb39eba5e84760e0f266
SHA14a53903833466ad67daefd2c9f8d72aae33bc1a1
SHA2560d0e789a0754fe963fb95f75890bd6a99ff227cf51c024aa21dba2e45395ffc6
SHA512ed8f9c831ce0cf15be725286fbc54b6cbde80939d37ec1c133ccc4ef6dcda7701c8a78ccd38313eb7426f0d8212c138ed572463bf8638c5d002c433568fb45db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f55b3fabb58b8b60d3fde2b6758d653
SHA1efe7acd29038e863fcac66e314ea2084f064fcd5
SHA25617285634b08b416703fb854a158acd4b4a00f08f39163e54e8b22734e63a9a51
SHA512b8eacccb4be3a3052f911c5a532b751fffa86435cfad985e1a3c042310d38819b48067bfff08a0820efbe3acde18c70baa36a5cfdd69244b0d979315d03d03f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0089ebee9fb2ff1707f0905b0d93130
SHA186e0e07c38995aff49983a8bec2fcce137561315
SHA256a60d2cb2e1b0b516983eabe6fc18f61e40c8d59aee10aeb85ad146c48dbf4560
SHA512aa7ea817ea603c953dbeb0ad99d00884eb35b6dcbf163a65aa3720da48951a89984e3eec2d0e5e80ccc0743052042bcffa44245ac0fb470a4dede2aa0308357a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e577b06ebda9f198fc4c44270d75698
SHA1686c65aa338334f3010af45bfdce7b9a17948125
SHA25623ea1d177a17a73c6f8286a6c27ea5684648489ad18ecdae93c2aafa3e2ae600
SHA512ec3275acdabf32611a34e01a33fffdcefc1779b92de76c6f2c8bd76773ad09aa71be9db7fa388ff96c5842c359be50259f1be2fef1cdd364d1ad561dd486b88e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559365dcf432dfb553f9ee9eb07b12578
SHA18aacec69c0341daec708f7be4caaed788aadfe86
SHA2568b9a82d886c325cde4997a30f7fce44449519eff89d130affc60d99a13c73320
SHA51278605246504e6cf97cd91162925b742c1d275f21272a2d045bb50036d6e58b6bfc3d45747207981e57c2a43a764df042124a95fc85d3300af59bc0cf103bba1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599659d0b68488ea571064fa478a8b546
SHA11f857cb8dd8cbba14c01d036a28001173d8123e3
SHA256f9a2637675c2b680e9c5c6045b82bbfbce38267399c8adc1ae882346787c0fa1
SHA5125ffa40e42cbc62ca7457d9a8bb683f9ec23281b0d926552a59cdab2fb0427bc72f2e76dff80ca28d6dca8b8580dd71cc0ad50173d4dbc4e7ed444c1668800ce3
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a