Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 07:40
Static task
static1
Behavioral task
behavioral1
Sample
74c567d84c0272d5082818b2ee6721a1_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
74c567d84c0272d5082818b2ee6721a1_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
74c567d84c0272d5082818b2ee6721a1_JaffaCakes118.html
-
Size
4KB
-
MD5
74c567d84c0272d5082818b2ee6721a1
-
SHA1
9a7b9b3269ef22ed49406159076912e4aff3e80d
-
SHA256
eb80f2096e49c1a139c4c2172eb19f965a8b48ada667fa2e7191b05e41fa4f0f
-
SHA512
3d83675a0cc6e3c7d9ae3451658f3f2ae59072ed085a4e784d7216a63fe26dc97a87ce97fa8b58e2448924c21a8338cd673a6f7aa54d80b742b1b963750a265f
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oPzo2W9A:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDw
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{38E192A1-1B33-11EF-931A-4205ACB4EED4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422871095" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000af16e2c0604d4662aa5122a2b1ab7d12bf3328cb5644fff3dc340c489a172b10000000000e8000000002000020000000603c93b58f539f62f48a954dcca79c2d18b6793f9ce8b538055caea0be1e537a20000000a78fda6f48c7ed6f20dd42c4301208a3e7abce54786a73f6de77674108740aaf40000000098d3cd98bae028d7cf2bd155c573f17f519e08ebfdb4c39f6c09300c72313a01f8d8d2bdc13dea6428742474a6d2a13f6fd060b8cebb2ab58dca82abf849be8 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1040720d40afda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000097ea0f0883bc0e16cb6f42ab62c96be0399779ff7fc636c4240ad587d7f021c7000000000e80000000020000200000008ed8b467d86e3804aefb7b82336b14834ec64e777f4a83a921243518ce57aefc90000000d298543d097f3987034b5059d0e8fca07123b951ca9dcb061bdb4af64d29b9c840b9d60e1dc1ce88a25e12917f1cc5d9931e8069b3165c25554b19cb1a3c505fc407950e673e5744779e413af94fc202aad6fb9172f7866095cdbc4aa205ba794da6367c5d57866ebe9335c787617971431763757c586da22df81e5875371ea6aa962081429c0b9e075df9a51802ba82400000002daf55e5352c503e673b082399907c7ed9d1c3785d14c53fd5b8bdb3f6e047f167d80ef085f2e54b96d955e42769ede08d100afbb7d0770d8a2d18ac2cadcdb0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 328 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 328 iexplore.exe 328 iexplore.exe 1908 IEXPLORE.EXE 1908 IEXPLORE.EXE 1908 IEXPLORE.EXE 1908 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 328 wrote to memory of 1908 328 iexplore.exe 28 PID 328 wrote to memory of 1908 328 iexplore.exe 28 PID 328 wrote to memory of 1908 328 iexplore.exe 28 PID 328 wrote to memory of 1908 328 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\74c567d84c0272d5082818b2ee6721a1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:328 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527f27cbc016dab0e44005d3155bd3607
SHA1748d41f769071c00f13b8f99ddc6501877d75cb1
SHA256dfa1ae2e403f1b55ec5cbb4acdacb38592cfdb59335c6df0a2605f8133219d61
SHA512cb41b69625daaf474712bb49b47f17791fe815bd0b0d27baadaad7cc8c0c7e0b37e77f93100d263556ac95c9ecd8466ff65ed349ee71870af67f25d8ea45262e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5965aa4fc30db78f7bc6552009a9e55ef
SHA1770e541c76949de591b4ce5b2145b26d0506a0b3
SHA256189e28c413df6d7c67c47a38634e8c11603f46fe186df4fcf78acd29996cfc3a
SHA51237297bf4d8467c302a5563f380dcd1271fa687fc29b8341665c74376ce1b89dff328a3829e82d918e928f87e90d58af6ff213f700e87447cabe06fcd5ee4c991
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdd845bb20d60c36e818d47c7be8b382
SHA1e6e76b19a2b744ba4e0c9fc05a4dbb3f7b281ec3
SHA256f685279ec993cf8b3ee9dd8c3f33f1574ff74e576e6c18cdf3260a8d4928c9b2
SHA5121d09a351b33afa35e4ff93e271b19cefafe056dc2456b40fec5be740ba66642be46031a9b0e4d5f459f92d81eaac80def8db123e6434c254dae93459d6fab5e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54578b8c59fdcd9c20ecdf6e2da6cc0da
SHA167d45cdb741c95bbd009620fca89c5ebd463d52e
SHA2560da3adfadb0b8b1d7f75d299501c1bdf2ec875c2a5ee12254e40035610c1dc38
SHA5120c30b586c8331662bc46dea73b9b4cb2d5d1256a6c4de9314bd1ea534a1bce0bcdcc4fa517667a6f002808c5b602c5059daa0721d72cb9de436d254d4888cb3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576c6b9515af7e5c1a5eecd781bbb45ec
SHA12592cd390ba82f43bd9844e726ada0fb7f24ad3c
SHA25655d971a10eafdfe95b25ed96ede061c64935e49093e081015eb3a9690abe8092
SHA512346a5239634aa5eabc351d9c834c2ff09977397adf5489ac560b8a5485f994b325c449859e309c3dcd2817df64f121a76f9020c87d746e09bc10b0bed3ef4d42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56671f1e092813ea8b4266eca226a5b77
SHA17039ea2745750edb49aa32c7a8ee8c414b1109c8
SHA256f15d2cfb3a4d063a3b2038965763e9311ca6d6a52518073605ed5f877966ef45
SHA512bf0e6b5d6f790a5f1c2b2f3f35d4628174589ce938bee4fb7e4e9e1c5cb902bc1049eef9a6290d9fbf5d890f879c79f61a7f1505abd31e9edf39c8871159067f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5485597578a1ba3626a3c56d2e23fbce6
SHA1eec5b7bf4671ff0d2f44262016ea018183996ee3
SHA25651e61c46f8c5299c9fa07e0c0ec1f8a41c61ecab08e88f4e8dbfc3dedd70d400
SHA51218cfd195ee5530b8cbc34e9844b3ad5af0f4eba6032ace4911a870215e7deb3321d464ffdc8cd562436edfacd035002c2a1dd24cfaa0bc53ea4e50f31eda90f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea6d2042834d992b1ba573d3ecfc1dde
SHA10e08507c2ec90165d4fe18134a6821838c7500ab
SHA25692cb4627dcc3443526f2c566fd90991b1e4b125691fc5b07ba7d7c3e25300813
SHA512eeca9214b01bd7f639770280b4c322ba2b4ca0b1425ff12f8ab778ec698866db9eca9829f7309fcda630cfc7b7687df5b373c6ff2068703d829d7f2fbb05a1dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58cbf45db645db9326ea92633026e925e
SHA133ab0d142641361e3ea18dea846e8e5ca9112e97
SHA256e6e50b4dc685d5398c31c767dc31624c6dfbf00c5eb199b691e2138f6440844d
SHA51224b3e86c3f3fbd8f766341cb16b9c798a3e3f59edb6da82fad03d3dfabe196625daac5c942f4f42cdccafa9e7e7ede6d76c33d6d40735666ff607355fb53f14d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a003d7c8bf03cfb49a9f2c7fdb20d41
SHA1cc4ab550abe1a6eaba899ece27033c9be193b0aa
SHA2567c211f885201c26dcc3a4ba3cfaa95a45c1c9c05728f14a2492c3124d83a9a6a
SHA512714a4ecc59fe76b4844b7b5f64412ea2700e28ef5430c0de9bd501f87b42b72e1a2c72438c4b34aaafb05ce708b45abeecad9bdbd0f9c590fdf7d7cdae2d3511
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538773d697af4d6df1beab8238ae3eb19
SHA1bc1929b63c4f181d64937f18794bfb009bcc63ab
SHA256e5c9bae99c5c87600e2907ec6b5b1999ef928d7cc03752762f93a48522847987
SHA51227f38ff110244fc96ddcb3eac57766238a63699fe6aa22ddc34ede5dea3c62bc0a0718ad276495a6c2f279eac92ae205ddb40f915b70d6597ea1bd2123e83409
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ed368d31185af409e5aaa631958dc61
SHA10c2b1dbd8d9a55f9ebf2e2bdd2f93f0d9c10035f
SHA25642ceb25d3a3547456136146492fcae119b52b197112cf0f7ece61c54088240cb
SHA5127a0f2406179fe4a0365f5dc71e86d4e37b7dd7354264308917a431c2a855177d1ea01b18418aeda5fa5182a29e9779571ad7507e4d2dce25b23f811bb2ca2c3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539f30d607416ce9c2acdcf2fa0bbf0ac
SHA1228bc7ca31853b8e35077cf48d72d70b1bbcac4c
SHA2563fb61cc096d80724076815f1f6ba9bc618fea0f54c79ea7a4a82f86351846a25
SHA512fe2cbcd7aa006619356691f0749b57cb996f379e6e1d07029361e416c28c2b0fd2ed8b208b6f93f0f26e860f0ecc485a3b74e1761e2a2c823df407fa6a3dc76f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557900c14ade13af3f2ed390344dc248f
SHA151bdfe6313a5406cf8fa8070a96318bfe4a17433
SHA25652890f27b600777a38e9e93c921ac93627bb7fe1453ddd4300dd84ec8e6b9dfc
SHA512a2af4da3070b66bc144c444386fec30630737642f02843a6fd165032ce03b1a7d2afcb73da2dee33118e234f6237426f0d01476ec24b5a9b857470ec1d5c2ed8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e04c727c30e9468ccf0b576b9fb98f3
SHA1661d48d08513c392e4aeb57209c4e15ce3dc672b
SHA2564e4c1c801c95015dc4d2f71754b3671ec9279c47c1327af200ad91b14d922d19
SHA51232d0bc849b67f904cde863ff3e71c63deb4fe5bf3c9f28f64170b2ccddb605f7407e9c36b4c411d200dc04915abc36f7211bf0eadcdb9726dd8772abd28848b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f24eb2a913d697aac9337d4c92e90628
SHA1c0105e137bde27e947cd2b4f269644a37e7d7b49
SHA256026ff7948bec2d36b11d666a2054c2e3dd7a42bdabd4992970d94d28637652ad
SHA51217fca656f3683e074c78ee7e105250f3006c65886601d11e798dd9fcfe5363c1568e3fed76434d72eb0385d1c6cdc49dfce70d81fd97bfd04d39cca6a5b4ef9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50cdbc672d621a3d5292bff72e0eab82c
SHA16a031bfaf653a4ac9b46bdac9f152386bb79a413
SHA256c7f715e17e712124d48259cd38c2b80f950f7eee018cbc1ea07e34ce2b352cc9
SHA512015399f706594a5386a51c9660d50c53eb964ee3855e627b33429dadb689a4383a782f705bc3bdf332c3bc8650a4926f9f3e66bfd648ac9ba8cc055618aeb519
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5415a46676acde513522456bc2e84e131
SHA181fcfbb1858f7a8df8a35df73861ca54a2a91e59
SHA256b1c020e55e8ced9a9b7702f6d03dbeee12158b66886d6280f843c1a60930ce06
SHA512938d1262728897450d3045adc7f4953888c4c4812e5746563abc95ff91b435263f298162c03bb32ef712b2a1ba39cdbbaa614bce0c401b9ce58b5b0f7850c7f8
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a