Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 10:36
Static task
static1
Behavioral task
behavioral1
Sample
7533fffe7b5f95f72b45bdcea18b1c6a_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7533fffe7b5f95f72b45bdcea18b1c6a_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7533fffe7b5f95f72b45bdcea18b1c6a_JaffaCakes118.html
-
Size
460KB
-
MD5
7533fffe7b5f95f72b45bdcea18b1c6a
-
SHA1
1fceaac9a5189d9d64f49b48c9c35e989e1ac400
-
SHA256
31f83b15f0ae319e77598054748a261843494aa8be96b30328f9df1a565b33d2
-
SHA512
e29e49ecda6adfaa1714d71478251e2d969fd2e658e1754ac4395af4b8d72ee5fc5155bcfce39178d73ee6f10672ace74ead3ed5d632823511da0afb94464cd5
-
SSDEEP
6144:SpsMYod+X3oI+YH0sMYod+X3oI+YfsMYod+X3oI+YLsMYod+X3oI+YQ:s5d+X3U5d+X3B5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 408dc3b758afda01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000004238a5dd6e7553dc5a7506bdde36a22a9782b80098aac7deadc12f263022f55f000000000e8000000002000020000000495c09ac724cf99a17e042c274f956aafc1e184ea5e91c108670cf38970d01ac9000000054be35d98b9996c52f10b5cf7d4d21fa371dd444f7340153d9a9f6655c5efc04ea1506cad30ab05f584eda6d3559d5ea24a3d8bc9905208a102e1ebf03d7419fcced93e54b36d587c6281704d75302dfb933809d41b0c7d094feaa12b84db492fbe1ec1b551acfdbd71a7c63419d5159f4dd2bc209558fd0827bf481098ae13a838c429681e33a9269f25db3fa1261fc400000007bc10e020ea03ea223957887beeb26b7616d78916b675dac343f37ac1ea6a631d5f0c5f131e9b4d02c1d1210d93e89417c234d8a1f04601ec4746bc22fb63dd4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422881682" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF358311-1B4B-11EF-8962-7678A7DAE141} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000004981cee41ded147d24dd0e03d7eae6b864157027a7ccd82a379e27371ae57f66000000000e8000000002000020000000c6b7dafe452feb81955861d5dd6be0b89fd2755560a4f168c9a0ac4ef142fc6520000000494e4f7e9ca482dd988363ea1616a1a558ddca4820353373c6dc9577ea4c506240000000f08684aaff6866a66cf42c56cdc69bf7d648881cfedc63bd98810dd26396298a151c6afdac3bfad8180eec1300727aa100c09be2c4a7115f5aac0348e4363f3e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2400 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2400 iexplore.exe 2400 iexplore.exe 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2616 2400 iexplore.exe 28 PID 2400 wrote to memory of 2616 2400 iexplore.exe 28 PID 2400 wrote to memory of 2616 2400 iexplore.exe 28 PID 2400 wrote to memory of 2616 2400 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7533fffe7b5f95f72b45bdcea18b1c6a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2616
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54bdefb8a9a9eaff404d8479e621225e5
SHA163909df6edb01be721a512c7b577796cf64dde67
SHA256af170d82859a4f8a204e3262db53dc24955139943960c377b735cabe5ed5b4b8
SHA512278a89f1766424aa9575982d1b2d7bdaefab436150036f123cf7839cb12b58d98f4fe5fa89434c396920d26e329e46aa848b95e13db4a5fff4b59c56b806c8a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4fc9d0ffb90f597ecadb86cd1e3f2b1
SHA1c942dc9a3f18e71361047f7acd5bbffeda15e72f
SHA2566aacb523d56c0cb575cc848e6661ff78f02f70c9550247b36b9b9bd76c8c668e
SHA512a6aa922393c6bf811b2dfeaeb6569da8cdd070a16139664a70d372c545317e6bcb75d578260dbaf2b249a51a455ab1fe028293c662bbc7bdd41f6b8c7fd7b401
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e17b70d51225837e3ba5057c6d17d82
SHA1af361222829c95ccd6ef3eee9af9b58b1fd6465d
SHA256e73923079725b703c99322a83c7e2cf87bfb3ae35567dbf5d2df1762f800e5c5
SHA5128d7d9447411629b7191a540cfac4b922c157a1cf3ae4e11b047f4150009b466942d7fbabf6217de51dfec2b60576955fba9f7da8d7873741cfda21cc325c4417
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e317a6d034449d9fbecbdb3b782de3a
SHA169dc4110fbc1a827938852968459a7d2150de175
SHA2564cf9e75c73fe95e082cdab4596c5c94c0f364df6fa5f2663bea04f1568a4859e
SHA5129bc0dbedf4ad216752c6dd0d14a07ce2b345aba3d56ebac0474de1f980155fa68b2e426293ab958108ad89615771fa7f66deeca4152e844577152e21b4b084f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5243c65a45041acd123bd6bb52c7a837f
SHA14c88e720df56c7c5d815adb730922c5fb444a74d
SHA256b30642707a5a6f4705c4ef267405b8a890cbe2b324e1b212d3d0100cc8ba6b34
SHA512c9003f793773f6db5c44f11dc433f7d0d4810296d42865eb936f122526978d5df42eb97eaa8f0e00fd86ec0336af4da6bc8488f9e5f7d99dfd3d0d698a488436
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54103862d7a8d3b2bf24c443981ceb83e
SHA1c71383d2e6ea76cc07ce5f84452b1e6b40655af7
SHA256227a03a2dd0a299dd37cc7f9d566f910d5277222143e8a48685940ae6e1a40ef
SHA512f542d5db2b885853e8f470fd8c5d7e8846efd2e8bec2cb9333335f7fd37d4b105a76ffba11c763e2b91d4d73a2ddfcc6c8361c70c5b7d5c7d935f36734fa74d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8640761753ee351ac6292230117b79e
SHA1a329db2fae3996a0a41be5c8788f2d71d4de3ed4
SHA256feefad575cbac3a2dbc7379ba74c5f73744ffadad163902c58f34a2fa691dcf2
SHA512ed9b3086672273b13378a7b4f1986209edbf00b91eca9181fe042de97da152b74e3f2f01527ed18bbf14c9a92d3023e75011a4c21e3b9a2018fc9cf6e62836a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5308a7d803505133f65d16ffb180406e4
SHA16553965b0b96b659cc04de8f98c99fff3c7d20cc
SHA256dd58ab28bb576adb130efdd0eec6164d0961287a751ac63676d85edbd8099deb
SHA5125080767b1061c140159f268c6c30db7072d3c2bb3ee4122ae2bda1075b78ff91e0726f65dd52c5af864515cd38fdbbc235173ebca0e08d7698b7db9141dab98d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5102bf2bd671525dd475ed7f6d20c6479
SHA19aec3a3eb066b75dd82507b213a970f263fd6f56
SHA256e6ba0a0fdf7601ac62d2f306256f47ad691abe35ac7f2d52d592a562c311db56
SHA512bc437b94b137aea19ecb431073f1cb11b7eb87b806901367306270935d51ddde6f779f8f28380e29139f5e22b6d0faf34787b8ce6d2f02b5bea32cb3dc2b44d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ecec98ba77f6eb12d2b091a8f983a1ce
SHA167704b22c5d609d18d92494a1a72a646270be694
SHA256dd99c006e7bf402c813767a61476d0e1b58ea460dae1862384053bc16dfb5e58
SHA512286a9450df0e8673840c25d1854dd5610763db88290ef129c2a32461eb4c00e4864283f74b7f3e7fc4a8310e076b17c19f72d10e337730ef331bc36c55b67ac8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c40d7047dd37922d0e42dff5fbcfbd8f
SHA1a72461994a1da47b20b59514f53e80a07b2889ad
SHA2560eb108cbee5fee13696490f9fb4e2c45c30321ca9468ae978549d304376dfaac
SHA512f7bbb75400ad8db19640e0cfa66561706a9d182ecdbea0342d66f47f4fe453e00e38c3efed4ac477b31fbcde263c0797ef0161f3e6741c97eaf798a83713e182
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef66c5b05b910721bdfbf8c5c5f09d87
SHA17bb9931331d22acde5ee0451bc75e5137e03c082
SHA256d8186ced4389c0d8bc95b5948ac83ba3cd421345f553eac9eb472fa8c4b49c9b
SHA512dd122189dcc9ba13158b9933c35629b242c4763e5ec86fd46d26b922ec6625521708bb5c22044c349535e92f9b5ec20f83285a907bf81449f13539603b277230
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528108701a41b6a269f29b3a5fb6e05b9
SHA119f35a2d994d4a294b15c00807de6da89955c337
SHA256aa689cb110a6d164697e5506c73934fb784cb680c2b284456f3e73d14fb73e9c
SHA512eff4a3ac3338d5d0891fa31e0ad061a457ec49026c98b5bfa8489362bfd50ad1f03f34eff40cf6ecece9f0302d3f8bf918e69332ad99b3aae17b7824110ec439
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5361464a35bdabb03cd2ed8458c1b456e
SHA14ab1b3427bea1d2ba692bd972250ffb26bef92f2
SHA25615923a73633baed604221c99655e5deb1809db685019f8b303ccb4ec7ecb000a
SHA5128ec1d6bafb5c922faf4b194f8eed5314202b070d8c84644b4d00c75363a8dfd74d5a410c4a0fc512cff39068a1167834f0f1e3abc8e41f7a5fc68a2aeb575610
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1c1231afa5909ad2c2a0eb2d3db7b90
SHA126dd334ee4df11f741b224c3fd20c2485b145872
SHA256440fbc8dd48ad03ee65111afdae01825027e37b4170275e240a43bdde3ea4ac1
SHA512cb96058ada5a376df08b817eee8963e6656ceb9c673d82c75ae072b1263d751f9e6f2bc58666a198f3eb2f0897f3c3284465c1f5336189c92b8fbb55258ef5ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be8c4c234c7272e492521cacc1a65b60
SHA1c5ef4bdb76e989497774f2318b3607e3d9c1c519
SHA2567a8116acf6853ce37ab178a425eb3dac92c07ae7c918655e9d929225fce9278b
SHA512046e5ef05f72105bdafa7cdfe3679f44852ad028c6347a47bd721df7f2f7c5e6411b151cf178303220a233a2cf5056e2e7c421d36cfa6c1bc6650e086ffbe50f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548fe0f78ea4042fe0c4416350bfc1993
SHA1dd28807d4c803935cad63d1a015667ce9a035d7d
SHA2561295f480766eb8bd0453a57cd3e8c872603cdeb05096eefb527dd3a24842340f
SHA5128b77481da6f09fb2511be0fd298470c03c326198f17e202ecc92a22fda01d698f885af98ac821ac4598a128282ad78bd4ff42f4601d0647d7c436a752e8203d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a68d4fb320481c469be996e6b1589d1d
SHA14ea69cf20be962e1c3d5ebe080973895ad9a38ab
SHA256196e5791853ef892d008d325b6acb21f34f10d5cca41047417ed6de052f56cb4
SHA512c8586d94226c7cb062b44a0600ad518eb47ac51473ba16f4184510cada0af41ee855b0bc891056e7a810623eece2e111b03a3acf0a6c5423bb15d3af00bf1290
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a