Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 11:23
Static task
static1
Behavioral task
behavioral1
Sample
755186e70449822ee32b8ca834d83be4_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
755186e70449822ee32b8ca834d83be4_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
755186e70449822ee32b8ca834d83be4_JaffaCakes118.html
-
Size
461KB
-
MD5
755186e70449822ee32b8ca834d83be4
-
SHA1
415aabd0222c944e3641ffcb64c343aa76d7faf0
-
SHA256
cdc1447866121ebaaa6607714bec434a0e9ffffb77a0cf043794d837c33b13ac
-
SHA512
4ac4b0cc0b5d15b33722ac55e67f1ddc3552dfc4716a57820c274418bb2ed78c3cc54766f3156666b89a26a62a9b7487578bd9ea39e71fbeab8871aee6a59cf4
-
SSDEEP
6144:SasMYod+X3oI+Y0sMYod+X3oI+YasMYod+X3oI+YLsMYod+X3oI+YQ:55d+X3U5d+X3y5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{62F3E511-1B52-11EF-9F86-7EEA931DE775} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000056189268c1a6b749b229bf9cf9b678be000000000200000000001066000000010000200000009cf975c457f324b607dafcbfe2f2fcb742de29276429211fdd7b24ba7f491236000000000e8000000002000020000000919b6408cca32d124cdd291f641c812228b7b172a8c0858217aef19bd3b28dbd20000000ca421ed6252878c79d393ceac0e207a5ae4c2adf9e53d86bde5d40643132ecb44000000013c895c10cf700066a96a6fa0fbc81a5f956b2227fec0462fcead5cdd5dfc0624c77b761b8f9ce04e9bb2c7a74e4dd9d8014f2cb094dd0c49b8c05f17f8e11df iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0fe813b5fafda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000056189268c1a6b749b229bf9cf9b678be000000000200000000001066000000010000200000008efb023600c430b10c607d65fd4d937611406f23087b3e9e550580878c4395a0000000000e8000000002000020000000e907039bb00b8d9f749f763b578b9c4f34dec320105e79593b11b705645dcd8a90000000414dff73afe4fe2bb4d9889fd882e7dd7c8698427319581746d89e1cd54a7ebc6ae12f2b5ee51f4509f60de3010d7f28e26864ca0d35d3446315335b3fd32b5cc6a52fbfb8c2fa4cc429928e1bc7d178d8767bfe38d0161586c63730b32798033d7f6d412b365c086b0561db56b25886af423322d8c2a0feeab3edbc7552859f2c0e383e5743d25a6063723c744914ce400000007be6b9bba49fbca9774599c579d4250f043ec18577bd8d4567dc1992e8617f891ea0075c7ef8fc6a618f2d8bb9ad4a934380535df4871021c810895060f0e31b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422884481" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2168 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2168 iexplore.exe 2168 iexplore.exe 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2168 wrote to memory of 3068 2168 iexplore.exe 28 PID 2168 wrote to memory of 3068 2168 iexplore.exe 28 PID 2168 wrote to memory of 3068 2168 iexplore.exe 28 PID 2168 wrote to memory of 3068 2168 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\755186e70449822ee32b8ca834d83be4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f096aa2318ef5d13b8442639eee35cb
SHA1b4c3cebcef46bed37cc6fe818bf04c439e593e91
SHA256822243bb409f80f812f9e38a177be38e8045d2ba5168cbc9f07c3f3888317191
SHA512a360b5c4b081389f25012d4f62679dd64227f987cd6cd08f326a72a571fddc0006777a27be2e923b9fabc17ee4a0f632caa327190eee2cd5b5081b8adf7ead25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1c9116829bf4a9f42839b8436d4896e
SHA1429555a5e47394dc50090ecf0feaa0ad33b76c65
SHA256791b323474c45fccbf8036c6eeeac5bfaba2a6bfc2289174d791df0cce858555
SHA512e372d6a103f53f42a616ee36eb7152cd646525549ecc116507c40bd899565024a343946114c0a66e55f3852b594e29f304b42c173040523931dce27fb86a5d67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e800b891dedd367829b85cfc70f6fe47
SHA12de769335ea7d11971308f9726c3ef077b32d15f
SHA2565da23f765447a340533c5ee4c2f996e8eab4900953ef5414f520566a3330e7fc
SHA512529956020038ab0a7c2dfa459993f799b4de4fcde385a8bb0d1dca59337c80bb12d9719053b6a48e24757028c01bab133eca75dbf2f5a7fb44719e5b1152bc46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ceababdf8daed463cc63a41477c88dec
SHA17975b4a70e00939f3553ffa61aa3b91d1d4b35ad
SHA256e1641c7430547fe193bc128ed4d100f08a766e8e58bdaf23cf62a15af931f645
SHA512315d6cf2a6e7fe4b4ebd71efe4c935e58c7582602320a18b8efd11d6923e2359011d2e1c948e1dafb8264d14d1cc2780910e68350919ed788bed0737750d894d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ceb292e2f367fe9d26908640daf73f2
SHA113dd1e4cb52a73e1488398ba01283e66dc100117
SHA256cfa2e181b074a78be3171a93387a5340fcd3dde9c3145f3c89c80e8ddee658e0
SHA512066b10fb427b616e8ea22d5b78efb0d97a13edb229d231345dd315cfb6192a5dc4b0d763271af239649082437eed6f2e5479ce5eda8e640d5db22ce5fcd27eda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db030c27db81f456f9b551678dea7364
SHA18bffeb0478cd3cbda091e86cb7d1307bf5fcdbcd
SHA2563223d3da61a34489b635abda23f6c2f51f205dd7ba4834af1b1aeb1457780447
SHA5122be10cd03e4ec05692c7c05ba9fe373362606cadab2fb280054cc2dd84e0280444ddbd1b59a6d53c710fb20694fd12b2fb329772c1fc32400325f3918a4abc35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ca7c704fe40f444a4c12ef94f29ae38
SHA1df4fac29c1fa2edff81502739d16a09fb2532ca3
SHA2567ce06d788850bcb5ca2572a9658e8a35acca16728f2dbfb50c68b73480ee6bf5
SHA512a30f7f8d918bf244df8229a054bceb596c494e666c6b23d8998f48312d30ab29309e704fd18b9a6e6afe5b2ceb073ab1a6d2686cdd036c6307b175ddcb4b372b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5015faecf45fc1da751098fe2f43a2b0e
SHA14ea0b8e130cba6205eb8b098d5420a3fb841fc81
SHA2569531b61df290c0ce990ead6dcd8486edc52263a7767a6edd39a818b9b4a0743f
SHA5124ba97ea65ba5bb03c70294c93c40c4bc9206329c7a37dd587caad1e5469a27affccb5d01f51bbf990713cb06231040f4bcd726039a1e9f2e886cafbf02a4d44f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505b2973bd3417d898dfcabe19fb26dea
SHA1cea136875be6169c14faecd0166409c7fdea126c
SHA256e2d45510c30e274dbf6557dade369049b505e25cfa047d4310fe5d9d97165a00
SHA51205daa6c92c89ea5c882265381abc86990b19bb3d4d6556773882aaf8d657652b2da9da56fd176c108136db082df7baaa59364d919e0c57d43be6e6c1ba00fbf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5983e473a0d28e656b925488cdb56753d
SHA13a8537ca5c2315b543c0eaa9b9a77b251739ae0e
SHA256e1f70492cf0bea4d1332c5d3e5666a1459049f3ff7d0cadd1e3dc9ef56130316
SHA512edfd65a7a2052513f2a4b116d311fdf1250bdec371881ebf1ea248a902ce9e45165f8744815225c55abfa105bbd17a6eff0cb2c33f33f9d0c2060a547f7cecf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb623101787da112972057ae6fca234c
SHA187a76190fb45781a290102484428b64be27fa120
SHA25600862f68636ff0033bd61b155647606796d52e134222761395a26cfc62ac7208
SHA5128193c055116a1b006fac16fd78c0237fe304a81eae5de3833b18e0a3d72acf5c679c5adacce0cfcce5f0853cc72ac332ae9098c1c55656932e380bc136d63656
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b19614f9adbb7f330cb80c99d8503b53
SHA136ca2d802be581b0c288f3971d503b0507ff4af4
SHA256b1b590df04704a33c842a9e4bbfa4e8ff721387c0527e34849b7098447c9b69f
SHA512709a0f1a408c391371d6dcf95b719f41039f59f23e7344d6c6974a8a8e032064fe9c36c986a3838770b329e5fd7d8a9efe357ee2aec7d2cd634c79dfc8ab390b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5040b11a7483c59bdd6193b1db23f5ccc
SHA14be3ae6789ba62a234aa21491da2d1f527d6f20e
SHA256fcc4b5b59a9112f084409c8b9dfe917d04b198a3d339ee2b4b0340acee87842e
SHA512d3e917127c47f057d0a9a76f3d793699513790b93a49e078b627b87dad777ff8b014bece07351fb51f82e3feddfe37825f4d294283992828a5b14aed48e8fb3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec9a5c379771bfeb96f1b497c9fc921c
SHA16f8311e4efc43e29711f4e9950e48d0263bc6681
SHA2562d314d9b777614988a3c3aeedab753c396bfc959f5020af235191e381a44427f
SHA512c521d1974636d4ae5134fa0854217251d11eca1c125d40f0df0c23263d7ea428c604e3e3767576e2e9a16d23cd5738f8e5fd844d950f6e1e76a8414ed67f44f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50aec50b82b52183cf91e2f82846c19c8
SHA167c9b9028cc47c5ab2a691e17e1dafc2cd4eae67
SHA25662608e64c00fc0d27c95afea6bfbbac921be2a983f5242b66bd27b1bcd562a76
SHA5127ba3664ed92fd7924e477928efa1a0d06bf152b69bc9c1cdab54ac8ee1b7525c9d6e7d72cebf209f73deb44f8247d5ea4291bd3875d004e1b74493ea8f39835c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50bf5c3d9affa4f9821476d89ccb93822
SHA1acca6a55e01e5274410da067e51c648a0d14c05e
SHA256d2a39b4ac113735a31cd39544621742e8a318589e5c378789205b63af7414d6c
SHA51209d592cffa4a3b60ce9cdf666ce1904ae17f8af35233c4cb3a738e8750a37072f8fe12a0b47c57bc0acea27ac2dedd463162dd2e91e9fe67d3ef7bf2026586eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc7b22f9f4a43a48056712f6b74b2875
SHA1ef714f49d2fe1713a5d6467abaefe6d7c0c29b83
SHA256a05f3ffb27ec3e08cffcb0c6dbaa05169ce83cd296229a7959850759b0082035
SHA512cfdb1e23df0ffca576b3110b6611fed80c5d4aa5ca6e5b72b1899fa4b0e878de2b74163449278dd91e0ac8d325d6d231e8f256ed790e608d5c6de896336a547e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583d7889669e65043727c81b0ac44fa22
SHA1ebd421d1d01755bedff184fcb760ef5c10451221
SHA2567403dc977629839f0dea56a3949de0d9da2268837fdc420300f148264c54e6b9
SHA512f61f54af68e14347c5bd51fef9bfeb67d8bfd31c3edd3fdcc865f623041082960fb7003488727a34305e646319dba3626e2f7dbae979b5389c01e4a668c0508e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a