Analysis
-
max time kernel
120s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 12:10
Static task
static1
Behavioral task
behavioral1
Sample
756f1ba078de7ae4ea67067e521d06fc_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
756f1ba078de7ae4ea67067e521d06fc_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
756f1ba078de7ae4ea67067e521d06fc_JaffaCakes118.html
-
Size
39KB
-
MD5
756f1ba078de7ae4ea67067e521d06fc
-
SHA1
97b101053b357393cdad326a1e089b7d92bacd81
-
SHA256
e1aa79b5d8d63c82b892e9d2bfc0ed6c05eaa0d84a634457258f1b30c868a7ba
-
SHA512
1c8ac70eb3ffea3ef86dd6cb5b9dc2784f21d3b0f5f3398cc88892ffa1a2b424d1d3a0269bf830c3106e6dffde1e71011b18f7c316aa97bbbdd82af357dfd805
-
SSDEEP
384:CLc4SXRlbCLtGaijBtHOgdPPl+BxVknrXL9jIk8tHDaVwDPZ+RbTHM/ei:CLc4SXR5BIgdPPlkcrb9sCEPZqbTs2i
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e36cd265afda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000003e17a213665560fdf6e817c345eb4d9fcd062957943eed0a944db2d00f8e7069000000000e80000000020000200000003d9fb77e9d601572d23e5e2c7051ee19f92e7b6f43027dac23b7a646ffc16be120000000162e881bcf972c6785648ab41111e7949d38cf36d33ef991c7f7701e13df71dd400000001afe12acf041999661f47df8df2c00540c4d3d7ee778aab9dc0d2a424966ee74d3eb3086f57865feb7ec949b6bf6c15d16fa171f74e1300db03a09dc70968ecd iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000bdba9a4f8e1a994d420b3382cdcf30dae137c242221ebdaa7ab93287a628d774000000000e800000000200002000000012f3e7c12c1f8660c699763e0c64bd926f27fa1bd4e21ffc4f89b506fa09c328900000003b8a314cf2de1fc7787fda612ed79780177e3d447f8a6de7adc0106fee48ccdff9a0f36251ce8f502e79d0ad2a3c7987aae889c79e2fda91eb596efc21a75295ddad774e27b12961339de238803a19d40033ffa56e0ef626b657f43f9ae539d11b1a5f1a07d9bbc1b668010044146a45c48214cd3e1d54d7462ea8ab40e807588f4f2c4001e547067ece9b9320eaa1d7400000004a84529c421244e5da795f623be912639000db2e7345d745db6c5c7ae67fdb6d6248dfd33cd26b63d0b98fe625533febf9b25083eda99067ff18633be51029d7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EC1C9981-1B58-11EF-8C71-D684AC6A5058} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422887291" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 108 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 108 iexplore.exe 108 iexplore.exe 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 108 wrote to memory of 2916 108 iexplore.exe 28 PID 108 wrote to memory of 2916 108 iexplore.exe 28 PID 108 wrote to memory of 2916 108 iexplore.exe 28 PID 108 wrote to memory of 2916 108 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\756f1ba078de7ae4ea67067e521d06fc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:108 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b99f9ebb654adbcfdf82ea5dc735f08f
SHA1b11de83f5ae8d3dfe18f3a89828b59f0e36783a6
SHA2564a3c3b3cfd48f911f6c0e3b8c63b55db4a61ad8137dfbd89a06c1dc7cffd3a22
SHA512745632992cfd715e155f07b0a548e10b60960b9ed673eb6c544f486e156a2356ecf0e8d0167931affcf8bac5e5a652f99ca134113b9565d7dba8b828a38d07d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b62ec8909bb2eb88a6d9ce67947824b
SHA18a37b007c0a1221f829f9ba76591940c217feade
SHA2564ad9973daf94e32cfd06ba53ef7bc52466aae14f1eab00e08bdd5e952ee69650
SHA5126a4af24d4796ae0782e53d634c965668886122a262e21fe4fa5dd97550a673273fe714b197f7943b69a00a7112a7deaf8103d5e6a84ef93623da18fcc0b3e754
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5adfe88b357f019b8016db4aeca671f2a
SHA19d2c23d84d1f7e6f19c71a8cab121b6b8306334f
SHA256925c1a4fd7fa3912ecab1381070c73788965bb6dce4fd09cb746365c63dd03ff
SHA512039636c693583a990d90202f09766ef460d2486295bf1355c87a75acdc239f07409ca310b7593f0019c8be4a33553782537fb02ba18637a2945d4dbece3182df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5794bc3c7efae98c10177f2a97f12e21f
SHA114e3707a6bcec0fed522e167e78d4faa4c785654
SHA2560ca4c17fa6def905eee327ef1c476e6c3c7c4df13555d8de45c76f9ae3bceb11
SHA51269c2580c77f7bb1600fc17781158e047ccb926d9ffd5e8da3d4d35ce17fda77f003b2563db2396fe57387257fe30ad6318b14d676796a6005e881b489b759cac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe03577bf5c07dfbbc94c22645ca6356
SHA14727fbb3afe0eb541b65862968f0e05f09c86f1e
SHA25684bdaa94a4f6e1d0270604f96adfeba416961210136ca54e429fa68e944fea6e
SHA51211ff31b4d0a9b3041492e94dd199b5ccc829d9555f94e4056b321adec860c569c7e2e695ca3981bfd6265c2b5cc76f56b3f941820310156fc755789a83522c36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e012c06fa6b4d3cf21c1fd01466eec0
SHA1a141b2522a8c0ab607b0dd7b510a55a40d7a8a00
SHA25676cbc90e80f8dd2381a2f874620b22130adfac2a749e9cb0c7e31c71490b3272
SHA512cb0ed59858bf92f65369619ec278ed85d46761b4d3a11098ce9e6f74268485d8a9456c26435b6aa1d90e3f5bef0a8d7538e51f83c756de7a4b03d4cefa4c1cee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57570fa524796affa61ef789d7246a038
SHA1c009653b59246c78c2fa74f1ab636968e23a4cc6
SHA256f92f9b87d629bf7d94c784f2ac73d463ec00c78f084cd4a7076cf2c7fa4b0e6f
SHA5128803c1d56992358f04f3e48e3cb2c97b8ab63b3a9391c5999bc5810769d8857200efba16816a900d96c3e54e19686517703f785a4eb5cadb2939b50964b75bf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503dbc55980349e11c53246554c240ab6
SHA1f135c79be10130a7c8c631108c79d22785a7324b
SHA25689f041a0647860e46d60be320358498170dc7d83b0cd048fc8a81b6b6c659671
SHA512f18499b35936bc51a8f99afd4d21f237e59e31a1c487709aea6b92e0e0371b1a8142043dc839544befc93ce6e18b86028d1b59b11c0b0dac18a0f0d8ccdecfd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5153cedaf775e3d3ab98c18d3e403addc
SHA1c5f2cdb3dbf4eef00849bc0d02edb0e646fe93f9
SHA256232276404a12ef5515af75ff781ff99d50cf4a454df72ee6166aec10a0155653
SHA5122fddd6150d946a952b6f3e656f6d5abffb2077aa8ff5e9f4c83644222d8b43c5f1855d79f8d09a5a524b8249bf134dac28f024b911cf83eb911b19f1f23302e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d676b94d990dcfda1fc058b2916d426
SHA1451a88599b5a05d000b6cfcb4244bc4376fa87f3
SHA256024aa0aabd7cd1ce91d24909ba54ea0658c35ac2b6088403bc9390acebdee365
SHA512cd8934c730f5d6b4645cefa6d117209212356c3528c8d20b8212d76ba0f0346d9c32bc48cad1ccc9ef46d07b22322deb24d822aad0e2c9d4df85bf99df44619d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52883b6e573abbcc6eb72110f268205a3
SHA15b597394c19b95394efd98b67a64562c5c360d30
SHA256908f7a89c26f90d8421ebc51e412b50156a31225bbd3d031ed98de489b0778b5
SHA512534362ece6fcf8520a1cd5a7c0c7b45fea92f9d73c51c35167f6c7cddeffac502f3ad1d9c5b39d745a37f265a573577079e7f0e329928df0eff7b49e68e67ebc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fb63312bde00f82bddee5b352748bbf
SHA1f317de60c96a46dcc48ad47d8799f26c16a4c567
SHA256f0396bf0397f7a52103a8ae57d28faf0e02c44a00eb87cea45dde9ae3ff21500
SHA512617f06093d641bd5a248b9057d292b67a44da8b88a68a4eef000a93e6b86c2f37f57021a50e182ba9e2f57e957e25097b419bffe889c236aea89f2236adc29e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5daee2f3a958c1a68204273805af35f51
SHA153d2270ec5569fc70a85d826ef24eb16759c0a88
SHA25673b067b18e5a41e987d72bf15dd0c4c291512dd183a2fe48905a517fd4385a7c
SHA512db820655137f526b84893cc98c0e1254281963d444dc52b82507bbd3b72890110b6ac14a57f02ac2db3770baed4ac0d25f8e0f9749601d6ef5b770d8aea84b3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575a6c9ad487d2be3c0ca2895bebe42f2
SHA1c764e4b21cd6f633ab6ce8ba518e706695d714b2
SHA2562b52fd8ebbd9e4fb20875d22db95c9b771ed08568c3f14cafd2d5b279c59a77c
SHA51241cc75655ccc41bfa4a4d834644185f4d1ce07a2a75513640d02a258b47fcc956e28933519d605813fe9f34dbad9f1ee218935bf72211e13c2d95643eedafb45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5219aedc723de36abeaa1499deaea8036
SHA1f504805c24b5c49a365f5dc0b64ad3bb5a4e9ec2
SHA256bf20e148880cfbfffa29c8aa91a955fd6d97cc1fd5a93b3e8059f7970b793486
SHA51259debe3353b96dbd9f840ce75da749de083121cabb314a0bf69413cf0aff2f7eab7a440369a7ae38898ecd98ce212e80b390c8bd750ba5b0d2895fce3ab4a041
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523d26acd5a0b8d772dae522dda17b3e8
SHA18ce9e58a45ef525f09e551748b6960d98ab5bab0
SHA2564689ee99465c5798d21d596d2e2860f6f4375dd23afedae4c0a3927585a714db
SHA512d4da022e180547782a13bb9024987b35c695ddce4f22c8e78e5975e7b39fcfb79bbfefbd15185d86b33872452f4e9fc184c0303ceb1b5701753c046f77a85f69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589fda42e1c3b958a423ba794b62ba605
SHA107965f2ed5a204058a563167b9b74eb3417c8f92
SHA256ba6cba8866ca60ee971bd5a3e3a196cc72617dc65628b4ca5f14303a2a3546ba
SHA512916fdaa2d31e17cbfac8ee5736243f284602d8c4906059915b2f845e874609a082fbaeff2147ae6699782b2d466065dbe76d5ae040a5da7a76928fe097c929a9
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a