Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 18:20
Static task
static1
Behavioral task
behavioral1
Sample
7664486cf623b56efdd1edf1ad7f417a_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7664486cf623b56efdd1edf1ad7f417a_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7664486cf623b56efdd1edf1ad7f417a_JaffaCakes118.html
-
Size
78KB
-
MD5
7664486cf623b56efdd1edf1ad7f417a
-
SHA1
7eec781798fa35719e7b0daf2ec77c08f8776964
-
SHA256
c4942eae2c34bd3f8d92a2972ce0ba8f928c127a9daf2cd1cf13fa6da61b772c
-
SHA512
479848f1d2b9c0ac9ac1803430b746530db8e3ea23be5ca6483cb0bfa1e9c98eb952bbaa321c2fd3943641d91e059d46bef3cee22972e0c0a7aa4ee1bdd3c862
-
SSDEEP
1536:b+UqVAhbfu7DVr7eDWN+c+clpWpM56wko1Q:UAhUr7eDW81y6Jo1Q
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422909483" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{99E2ED21-1B8C-11EF-8C92-6A2211F10352} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000001eee069f3a191ced8beba2d9f8a411bbf0c3c366b45f19eb27a3363931ec980c000000000e80000000020000200000009e9dcf1d125c8714a155e38078aa9bc316628474cfb41e769e44a687ffbc8c2c20000000f8805e7d1e6ce0d3943e7cc168b4504e1f6e45c9bba75961235a77ddbcfbc143400000002428cbe1b0aa06915a9c0c737ef6ed5dc2d7f1db709e319de509ce00635be54a1ca8ad169603e0538a6772d477b6f1e0b607212b8c7abcbb49163440ca34f7b4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000002cc3cb6dbcc7ec335fb2f5c989ebe5021e8dc81cb1006ff14ebd67029a2f3cb000000000e8000000002000020000000a932e4396e61622a50a0ac91950c7c7d3ec4430e1c727bce426ce3a336dbee9890000000e9208601b0e9b56e378b38e21219a92a2e922b0e25848b1378b0535907cf8f8df823549880704b734e02a3e6a3f7456a4cb0b1a29d3fe4a5fb4e7b15c64fbe3a36b9184b7f32bf2db416476e326e26f0e5b5e433e5cfd68c347cdd35db3cae896c931a07cee01cef0b8545cd28b53753278d3e8fac418bd76e6863386c91e609ce2c3bc3adaa2782ca25792e13b21c3e4000000073b82911ecfd4f7a4909b93546fb5c9a39dbc84e91085916f77fd300e4791f98ba082b2b212c260cf37254ba6ce9c1291a301e22891e8bb42513472aa52520bf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0430c7099afda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2360 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2360 iexplore.exe 2360 iexplore.exe 2324 IEXPLORE.EXE 2324 IEXPLORE.EXE 2324 IEXPLORE.EXE 2324 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2324 2360 iexplore.exe 28 PID 2360 wrote to memory of 2324 2360 iexplore.exe 28 PID 2360 wrote to memory of 2324 2360 iexplore.exe 28 PID 2360 wrote to memory of 2324 2360 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7664486cf623b56efdd1edf1ad7f417a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2324
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5728672b638b162b05df8c13175d45afa
SHA15208eb726e47434b8f194eaac992ac5cf49c7cce
SHA256d27ab9d97b2dd91c839e70012e0c785fc9df85a551417dd4892ad1c32b959e1a
SHA5126e6434335c88edfd743aad4c60a7f7148527869beee32004925aaa794ec1387feac35cb210027583b1a3584652b06ed1f0f4da23845a51c1a6046ff98b3aee62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5897455219a715f134302cbbf2e512e79
SHA18522a0718842c922a1ed9e9a44f20d755e0b816f
SHA25636c84275ebeb76bed5166b1a6eaa6f8f7d512ab0f906fc2aa785a693b059402c
SHA5120fee5916ceaf1c03bbd306df1d1a9986948a0818ea3eb360ee7282626f1a3aea2c8ff26f11acd7b725c7b3e9e6d01497be1b142ac01f338c741b1680ccee2346
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591c917509b8005ffba92edcb653aa0ac
SHA10953a1154b238dda7533efbe7e839788d5738a38
SHA256b3e356f8d713621fcff117b5117f320c89380a404f36bc73e58a77df20f473cd
SHA5129898f0adfa4a3843f7cf1834b403b57a6eeed1654b8e32ae5363cf725d477ee406be2f793d7a6f245e0257a149dd2380f02f0664db787c8cd920599894901c24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587b4c25f5edd266900ad9c8b97838dc8
SHA1c79ea388ef32666707901468d33196951c064faa
SHA256f15f2c02a0521de30e8fe83acf7771ff18f6bd75aa89723e377f9020d88433e1
SHA512cc03db5d60a443f0c47146008c99970c50a9fd27c33181d0124e35d54d781e5d514892127b42ae459840074df01889a0b034c54b22fd3a3dee643ebcf286f85b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e24ef738aab894b7ce88a8599600ebbe
SHA1d21cfafcf9256058dc8de60880811d4d678f470f
SHA25608afbcf355a373e1a513bc1ff063d464e0f146c70f34be3c73e1115d7fbbe25a
SHA512c6aa9aec0303796f2733a52816401461204b7386b76d39195e6309d00bc2e8cceb07cfb602912f254899ad4d9be31b14c02a7db487696526bc78b51ce01aabbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db38b67086e5b30053b03b43fa9d1cfe
SHA13919cf7e3fb5f4303daa94fc497895c5d8bd7ec4
SHA25620d5097e57fda6a604b1cf0da70ea6bc9159646319f5622132a6f13583582f3f
SHA512effca7214bdae4aa68c8b1c9d05c55b2a8f9740cd358787d6d4aab9400b45425d5317f1c09fbf3565df9f00fe8f8ec4eab48fe27190aff2337edc7fc155e2f58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5272ebb870ae81af83ff6031e91a5f697
SHA179274564df240199b8ab584798ca0b5ecda5b86a
SHA25644c1495484ad8cc526d8c1d086fc9a5abfcfd2aea14ee2867124be0ee61e5a3b
SHA5120103a99ab8a0d297d72cccaccbe03fffe7dfa685b36d296658d0661895c0f607154a01f7e60c6e6601d73841b725db84979814b8f58b4d117287b62f8e7d141e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58905d879d2357646f6a9d6019fa328b5
SHA1d3a5ac20b8f28444cbb08d1f0763e6d273c687de
SHA256dccb3e39a8af752619bd327aca903c6bd5cea36ea4b1f5a0395bd4093f9542cd
SHA512b40412552e71fa02c41ff753588d72946164e637e330b6f3a9bbdc3b85d7e1f4712fe200eec3e247195e7f285340ee7e9642efd72060103e0f6199d22856271a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53620468392eff1b5030601a013f9e9d3
SHA14cc0c477cfa6888f2e7321b4c4beecefbc6394fe
SHA25650dc54b03c097418dcadd75377f655c89aa2cd7d7730889f6e2a4953f913b653
SHA51244472adeff5d72b1aacaa826f093f13fe7998bc134cd405031fdd76345635e392a6565e5a570d97785a2288d9d0ce591f1f9afab6dd79e38fadd752b1d696dd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53df9a0a6d778aa72416d2fcf31e1ffb4
SHA16538b9c693553c3e56ab279fb3850826c0d2e907
SHA256ab7a642fc1a5fb9db7e09260a372b2c3dba3887ce20f58bf1eb647ef74ea74b5
SHA512edba80ac5f68be86d348711eb37433747c44c656af07aea42ced1aa98856bdb449500fc2d64ed0940199f740e84d5cab9da797a5ef804bbffcb3633fc8ae42e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55cb70015d44fee1f2e390163db50418a
SHA18eb663883987abb34a1eed57cf1d025cceea4a69
SHA25677835fe0e907d85b75213ac1461efe8cb5765e2ea6f951d5eec23d71f8f1ed0f
SHA512602aadf14edcb17a99299414e0e179718f334a1e48265a63062a14aa05c0c8e75b485fba821f8bb45e14d7335e0183e71b83025ec07cbd28eda338406bbb3789
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5adbf15b2ab8c65b0fe0fd020c6376b48
SHA16a495bad6e6b102cbaaae4e5a280a7bdc3391d5d
SHA2568617407d814be10504e73176bd72af27d096c8ec34e68b4fb66bc61083f673ef
SHA512b724169e8eff6b163236d1070163535104ee02785f25804d5052c8ae4c7446846f92c16377db0fb26cdb167000746d2857a496bae9fed5a9cb3b671560b88bfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef20857bae30d34ee6a5dcc4cfbc77fb
SHA10de6d7a9beaa0fe5d8ed68236319b08fc27b42b3
SHA2563b08f2ab71b87486cf65a0ecc126dcccc1fd12f8be2602b14d7e89703a36ee9d
SHA512941513e2cb77a4a82caed20f85df4dc4fbc4f69626ee8ab74fd743e3612719c54de8aa1bb3752f32b579354796a62d8931ec4121dcdaba52e15608eb1293f7c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510418f40660239fcdabd00223a697a4a
SHA16bcc4da2908c14af1426c67e05d61eb21f121d0b
SHA256fdbcc50792acbad07b81368eb63a846eb4dde213cdd671d112a48b90f678ce6e
SHA512a4680eeea0a70ef17da772d3e0729221eb95e0e4db9bf108dbd0b1f9f6243b924245a43749b4c47cac8a5dc01f5db18472ceefbe5faddb7be481f2c4b9ab229e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eeea87358b4070e371d51108be51f174
SHA128bc1e9a7461c88ccdc6bb9564c5b9f555edf6a2
SHA2569a0fcfff82aa850d05997e2de33dbde6afb4444dd6942c7537056677c3c24aad
SHA512f3235849e26f97a8c37f117f490e3606dd9ccd74f9aaca70c059407ddb93fd0aaaaedeb9b39dfea99a964522b0972d3ff54c96c3a9f8ab8887ea06cfbbf43387
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc7c0aa84721848834509568abdfd799
SHA1d15a9f80137042b223133e1540f0a503dd0ae3c6
SHA25610a28aadd408cd445999179be500f7250373a933dae5734ed1d18d3e8ca05099
SHA512d3187a01380b07369c5ab6b96abb0688cea99de902c9dcdda648fabbe1835cd5f958935435e4b98e6f8d0208eb0e024ffb2942d90bdc11d36cb04716a94d182c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d747e7e0b7d0abfcd88676c344e6548
SHA10a8ff10adb3c14a4d4bde3b628a4f1c9fd5bf2a7
SHA2560ecbcc1e538ee748eccf3bb8811331c49fe2f65e59815001734d6116cf5ae3f1
SHA5123357a10b0ef6c8247a9359d9c11da01eda8e8a13f3ba505da9aec23ec3c02edf011555c9d6aa103e0be144fd0f6c26352191db3aaf4528d6c18eac83a4ccf9d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD5db3a7149c40ff0fbfff6a79550b8951e
SHA12fe19f478fceb5a3dfa27707c7527e4770a7e1ac
SHA256320cb58acc1f0bb2255e70cf5dcc8f3c8b78fbdec1dc9311b92ef1288b69b9f7
SHA512896e1c40a57b1c13af68d0c1c0688a835062e29d01698be48e57470573a2a5a68dc1a80b9cd7f4ddb9b36a569c4f808e372a03b781ba5b0431efb9b37f7babe1
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a