Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 18:37
Static task
static1
Behavioral task
behavioral1
Sample
76704b77fbca8ba7be68a5a877cb0904_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
76704b77fbca8ba7be68a5a877cb0904_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
76704b77fbca8ba7be68a5a877cb0904_JaffaCakes118.html
-
Size
125KB
-
MD5
76704b77fbca8ba7be68a5a877cb0904
-
SHA1
c74424cd491f651e1169c75755f107dba68c62d9
-
SHA256
2a2ed394bee8b062ad85f2bd2f09a52e21d9dfc971cbd858690644f692633fd8
-
SHA512
f5eb708bcb51b579e93eddfda8fc7b79f87125c836e9ec4e7c5dbdfdeab8b1d56bb4a0be70ea7ba35d74748df63e72c41c250bdeee0262d62271dec9be69c41d
-
SSDEEP
1536:TPdj1gCnecGs23LvsJfzRWDGmRWkPFv7BYCw1yOUrRV:Tp/U3LUp4zYki1yx9V
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e958189cafda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000074991c320359d7de6242da2d4ce639e4cb3d3a17a16e150ba396513bdc0c91ff000000000e80000000020000200000004c5c3a20682fa374748eee9b99cbc1062273b43e1596581e03199af6534b480c200000001293ef7ac2bc2709fe440baeab21e49ef57c41dca08b8d53e547b5f1d781f6ec4000000046d8eb11aa72d27f571dd9ed3707a382d316991354609fdd949d95ee0a7251026b20f2eb12ed2308710710c0dff2170f3e4c908c2a373f25bcc84a7d6913dd31 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000b3c80e3b334008413cd03060b55a8b490e756274db59b6523c950ae20a83d10c000000000e800000000200002000000060f3addb8bd652ae627d0c95f6c8a7acceffe771a37cd20c014fdffb4e7ac6f990000000ea265172a863eae2a25ca1536e6b34776db4fdbec082ee9196f238af3b34825e88e43b080ab150de190c980c92324497754039fcb7feac6b83f38b0db03a4ca3da049b01f04f301a7f03c27348e47aaed86941ecb8ddd7ac7c94aeee8a83abf7ad98dd3e62646bb09c531815345bb762b337c736713867dfb5313507819c8bae607c720895fb3c5b1c60e7eb85c9c91c40000000b814c47ac3c94ac5070ea7a3848dee68b855285ecb5e110006a9a42adfa0a08f0a3b1241cffd24399846e3196033e3d6a4639461ce34db626b6611e2b07fdcff iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04A24F51-1B8F-11EF-818F-FAB46556C0ED} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422910522" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1924 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1924 iexplore.exe 1924 iexplore.exe 2032 IEXPLORE.EXE 2032 IEXPLORE.EXE 2032 IEXPLORE.EXE 2032 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2032 1924 iexplore.exe 28 PID 1924 wrote to memory of 2032 1924 iexplore.exe 28 PID 1924 wrote to memory of 2032 1924 iexplore.exe 28 PID 1924 wrote to memory of 2032 1924 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\76704b77fbca8ba7be68a5a877cb0904_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508e2669c7379ec738569a2f9af6b9e07
SHA14b04953a5a9728f4f2be4a91ccfad4eef2d3b1be
SHA256f466d76f867e927265a41a7bb6339c7c68207545376794c6b260424729c74608
SHA51265b47c9b2aa5b2ab441374bdf82193634e6d610357cb923861a54aa785da19f49f55343b4e22d4868dcfab46750b6570eabd29847e9b018600e79a2fd44e3d36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58bf0e9ea75e281f19de103fe7bd1258a
SHA141d5fdbe77880e0d0441a8304b56af337dbac3e5
SHA256277c5171c5647e2327245c612ca3fdf777e849026e63b1fedf71ac38ba42c5f7
SHA5126fa9a4af527c7f5787e90eb8c994ebf6b4ebf42d0d50284ad34020a400ced2edce0d2cb2ad7bf6a6a0ff857fedac1eaf303aed9aa4824aefe0b70e0933afe221
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f68afe759ba2902de17acba7bb018831
SHA150d16b3ec81c18efc9e189c1a5c974f44fecefd5
SHA256927879d737a9f2ea3fa76e9d256fafe2ce6fd95cfbb75acfbfafdf26790f5664
SHA5122d2a64719ca1e68750b2abc0956df5b1b4da5b9a19d72293a4bbc80274b694b52dab30dbc00fa007cc4df845a9cbbefd57c0629848c70e455eb3f96c560b416d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4c23a58a5a1256134803d34d81ccc83
SHA1fe1329a382b6146aadc581421c510bb7821a0232
SHA256db4382b50ab0417a959ae77dbc3b3c0c10c85a15c33d6d2a6e06f211a712e756
SHA5128ec99257761f9362892fb6340e1b5a005404bd99c46b739150e648db46000668fb3a2370a1b2227338b3e18a3b1c897d32b1c0e429e180145188d5ce5439971c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513651a67aabf1c7505e219f53599dad8
SHA1facdda38e85abc40c4ba87ecaee63777f51c77a6
SHA2566c3e6d0c820521969d561cb785405c06897e9c72370b4ea672122528162c67f6
SHA512399a9b9df7cf777963b92f34ad390305c6ce510e7be1d16e70146a2de5a33b84aca1e36e31cce1ed2b94bb3c7bd778d13117bb61e815c0702b9427e11e255db6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b3af65a74d042a675fb3728b7fbd04c
SHA1efa0440b2248194e34d86c6355c58b8d6280d83e
SHA2569f5e1dba2549d285cb33f276a271e377f5b51a99c1d811b96de7f0f4c60eba6b
SHA512bd7b2b269cad8dd235108900429c33280af0f47ec4bf08cf6050216b09d56ba4463dc4b9367e2b66ccf6c0dc73e65a72718cf0369cad6db5d89c80183a86f046
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578981a69947f5f5485ac9e3abf72b51f
SHA11c1383117fee28fe4cec5070106adf16a6afd916
SHA2566036713799bb53f50a9f1bb3f6b18f371d7b20f08493f83d1bbde7356497dac7
SHA51269edf772b5b0e934e5865e18e36bf2070afd7fffed997ca05786d9b01bf3bcc252208a2c6a8aa1b1aab10f86fee27ee52aa92d1b708bf34948f6dcbb67d55b47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56972dbc8d4fdc2dc8add78f6a15f23fd
SHA1315ce80eb7058bb6711ca93a8839f4ff6d1d754c
SHA256b1c680e5a71a302c9f07e3c34b5b23a60e0551a495efd7ce1ab8381146db9223
SHA5126ad68b424b23cc37c472538b60b9515677522e44e305752a811d0f8c8afe713e8d13d11b085fcb27b6406bab74a4087ff9590969593c68e72e89c8bae8207094
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa6316009406e05fb358ba113dc607c7
SHA176e39f428cae99eb44f955b6bb781d6780c8e37d
SHA2567eb67a522faf645febf9b239470df4a490b003e30b60be191fc8fe72b8648f4d
SHA512ee0509cc2a2c470664f31697ad3384b943209163c5a4fc3213130ffe255bcce8800cf7f0bb1957497f3fd283c0f7323a9e065ea4ac18b3f6076c0f41d4a91af9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56763e60d68a25a2ace780451cc147c15
SHA166dcb71d0d76688c57c733ea4dac887a338d28b0
SHA256807faa2ea564e3fd5e2df8813a200cc4f0e795cde9b7eb6d53277cefd4a4060e
SHA5126e2c0a1083a8962ddf2a315384e3f07879edd4ce5af7d8069bd243b0debb34773d6d5749c0adfd6fa0c788fd4cc778d800e8095cda76bf832155423c0a8c2d79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5493a4d7d9bf48ed0562b632f85e8857b
SHA18af69eca8083e503952d07508c391df206fd0e39
SHA2569300d87aa2c8673b21cbac7bc711026be6aa27df5bc89d3fc8402e1c30c08888
SHA5126a3e25d55aa81b44acb9535906a8e86548d9a74e577c19163a73fff7c8c22ca3d0c9304637fe301cf7f2c58949ad357fee3ec25a7c0c7253322f4e7fcc9732b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555a1a4176811af6d47f439e54bbcf0ba
SHA15893653478b29cb7dba541059cc09ea31de22051
SHA256fafecfbb3fd12b9e7c95d3482bd36c78cf591c84a80f3cfa7394434db6780060
SHA512139b082cd21790b41d2cde6e79e8a398cbd2db9f486dbf9f18f27191df8a6ae28a4fceab8a61958deaef4068c76ef98c4cbe671395b80dac0903037878cb0cea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55824e9ad9e1fb8bdd8df23ee264f4ada
SHA1645ca0aa994ba006e96d997e74f1fca542e1f7d3
SHA256b922815a34ff600f19070e12c59af54e4c1690e03ba12cb6b2fc6188bb3b6226
SHA5124214f804523d0eb40eba3e8b78f9ae1e4cace95dd7c4551321cbed25a89e8bbdbf544b3825d443df17df0047895d2443d54fe06c0f1ec3861e48cf471b3f2ca0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f07645f814f15a360e2be752c48736d5
SHA1ae031199e7b1a4e6f19611d50ad002935538e410
SHA2564ccaf612b8f0b7347eb978cbc22538193dc1953f0dfee00cd9edfab078628477
SHA51278dfd041957dd1760ff75d9265f89748ade6bd489246f849455406874ea9b7b73abf59eb86c1969cfa34729c4dd2088f316c2b78fbc8c707b10ebccc4467d2fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585245fca2baba506ee1bd6c6e594379f
SHA16e3e9172e519e2ee528344e9a8c6be1ae10a63cc
SHA256de14b137732fec5b62bb35c042d5f0c99ee0b009504268f94de83220b4b2ece5
SHA51200c390feba99f8fa71576e4321fc5fb5ed4e2cf70fe12286d285a20d4fd4f9de2df062af7d6f902284e308badb592368a2ec8de0c82f6ff9c43ef581391ceb70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530a85293c383fe13d9fd9b3f90cf9418
SHA18957713d26126683a99152ffa4a42a1607a8e588
SHA2565149f51b755bf2daa7f3dd319238d3a31997d8146c85426c785795845bddd9b9
SHA512b19a625609eba8b19463f9af75c10ee3a0d941fcd5e98f4b5be41b7ed758ff36a19f3185af83b434d747024c49ae2988b9abfc0195270e46a48cc20c356ed1d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555cc561066a536d98c16bdc307ec3414
SHA1d242ea89804fb4e05d29ff1a632c4295f9121472
SHA256c44ed052752e612ad1e5216ba4bbddc43684ce3afaab787cea7b313a7e90055a
SHA512b01dafa9c2b5aa21638192e3e03e09a69f47fa541c1a7328fa37e89cab86b5e199a766229a34c7c6d44adbea94b09af27033fe325025b0baaf516262d39e28ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9b05da61a84c3bf45aa34e04e6340c6
SHA1e6fc175099841c7d0341b06abdc700451022f56b
SHA256fdc803f1196f7f155c096c6949fafff0fa02b0cced154b0deb2cf6104691579d
SHA5128ae7009e8b5db82ddf186e2c09d60e4ef4510ee274b77903fce6a455dae8fd8f5ed4e4fe801ad1730da9c64421532d4e4f22667f26545d6150024de5a3af6b64
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a