Analysis
-
max time kernel
139s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 18:43
Static task
static1
Behavioral task
behavioral1
Sample
7673d0df55b35c0d015f505c109d71e5_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7673d0df55b35c0d015f505c109d71e5_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7673d0df55b35c0d015f505c109d71e5_JaffaCakes118.html
-
Size
17KB
-
MD5
7673d0df55b35c0d015f505c109d71e5
-
SHA1
e69b05468e08d185c1eabed19f5e242ff066c887
-
SHA256
5834ed3cebb06e7491e28d330150a884f58680c8a94a919f8ee893fee70f84ba
-
SHA512
b23e421ba89caf722e32ffccda996ddd6fb60e07fd7bc8b3c0e5a593438dcb15f84c3f8d5fe301b91c0a59312d883765449b37774b65d73766fc888d2a918939
-
SSDEEP
192:uR2Ry9ca6bf+JL/q/mqxfYphGWGjZhPBGKxAZ3W6BGwBBGtn+ZmaBG9yfpB+aBGQ:tivZf2qmFQhToKP
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000009e170ed2191e14ab9842070fd6cd11c000000000200000000001066000000010000200000001d297006954b5c53884aff5cba6f23e0252133cf884a184c19c04cf8e2b44fe2000000000e8000000002000020000000a80ed9fb3d98798e442f94af07eb7cded2414b4826d69f5ef5866d7fb15241172000000088e0ee126f678b60b2fabae2635b101d651161366c7793768ff2db8e14d5bf0f40000000a1024225e44cf672d7328e2f53653dc2ed98c51eb8f966cdb0003844c7f7f66e0a9cb5d6f593be125a52296ae84b7cee81d7ba03a4d0adede77b76a482590a0f iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422910872" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4616281-1B8F-11EF-8698-5E73522EB9B5} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000009e170ed2191e14ab9842070fd6cd11c000000000200000000001066000000010000200000007e7ff8b927f50246c7e5935d3c9e23db59c7e7ae2e46b550a4896cccf8d5aed6000000000e8000000002000020000000b2f245afa0dbf2f55f97c9a8026ae7bfe7c638f0451c1c4f4bfa5e5e753e548390000000a76b000e8d0231f384116e162b63f2bfb0818348468620c08af3cd9ab627e6a0638e75fc9172feb62cacd7843db0e4a943785a19eca2ea70e11165c39916afb81cb82cbd5d50939f5d1d7e3e2a874c38558a8732cc46c4e6caf37f9d0cf20684f5d2800fa3478e07842cc07db577b38e60f6df5beffd513379212487c7dfe6e0c807911bfabd970d6ce83157f656478a40000000e82bf369997f8127b2f8c660b306a1642cb7ec0a5c1d94cfab96561df0b22cbe03c8f827ebe2199c92df9963c2e33007e49efc34342a2ed342eb54930b29e86e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30d668a99cafda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2812 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2812 iexplore.exe 2812 iexplore.exe 2204 IEXPLORE.EXE 2204 IEXPLORE.EXE 2204 IEXPLORE.EXE 2204 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2812 wrote to memory of 2204 2812 iexplore.exe 28 PID 2812 wrote to memory of 2204 2812 iexplore.exe 28 PID 2812 wrote to memory of 2204 2812 iexplore.exe 28 PID 2812 wrote to memory of 2204 2812 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7673d0df55b35c0d015f505c109d71e5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2812 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2204
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e730b13c08bb75d328e62b30af768d2
SHA1426c1c5ec36a81125ec09a19aa4e36dca61935df
SHA2569246f0c8e60437068796b780c1f32f9d0714797d8e408d3a57e2837473241b00
SHA512f05eb5cd3f989f01b9179d9ff97e5e90bdc96738f06c42194cc680f24fa158973b576c02a7704838de048cf955d493e2af0bfbb8e956ce46083211d53e1f366b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539c241d1d420d20e6149266047e54561
SHA1d4c8efb918df81289710fc9496bb124130df4ebf
SHA256bd5fe128659cd9052a058ee88c4da9552a65d5c462c0863218e24cd95eacb1ef
SHA5126c0476d89c5d49b911864e3e66a6f536614dfa4feca76a57af8955e37366089fdbdae6d68490b0d9a2269338fd6465dda40842158412e118a0483165dbaebcbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ee58169ca6c548b1ce85d0af7ea1b15
SHA124b275de69d7681d0ce6ebebd0559c77e3138d6f
SHA2566e4cf98e7603c2b3a6405c08d539310ad8ec198812ef6066e2c6e95a9ce886d4
SHA512cab1a26b7ef6305977b5bf384c33fd57762486623458c579d62183a52ed58b5e4a6c57f27eb2866bedc8abee56a1dfb65b07b54b09280b0a0ce4c9560c2703bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e144e8b4cc688830978bb1abdbddb563
SHA1f91471340af24d266145119de84744e946c66b62
SHA25688b675454de84eb53eafef9f2af5c0faf8ccda33d12066af68264b25baa98d96
SHA5127215c6a0eb164bd8577adc5be9a2ff7b6bf21099ede95d7a12ef704de2e1a932d877d0082412c04c1ef56d616344c3d68b47c3c8be89afe5f0484addceb17d7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c98fa4484c0e05d58f29a6064b7e8c7
SHA1e83110c5b5cf35c86ed0da38b9d3dc76da1e6b18
SHA25645b5aa2469cd9b31709fb821912b5fb2225667af5d946ec72cc27ed99a305d49
SHA512a264b48520d9263191e5419ae47123b85b2f36180dda5736526e7a3f353d947a50e1d7409e6ec62747eb91e7460a65c05863fc80cbabe7874936cd5b1fe69df6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7dbfc9db7e9a26dccb362033691e2a8
SHA1f4aba4d4c11e7cc41968e1c227d6a3230e512f8d
SHA256b6a8a8a08f1e7fe11f9f92d1cbd8540258e5ca151f640926c1381cdb8156778a
SHA512bd9343c4a907badeb2a063bd8e7f76bfb694077e7c57d5e43cf13eb9a701db2f4ac6291f5d2bb3d8fb515277ef60554c9396718bfafd8e35ebdb813afbc60135
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc8aa3a513e88cc2277f2c673a5056c5
SHA1a24cb391306adeecc33dc5e7b8559689bef5388b
SHA25610b805047761d1b8ebda333f0d8dffe44a6baff985f74eaea870d821ae6d14fe
SHA512d4b77b141fec291b9bb38ed12720e79a35f54a3526343aeae86439752f731f61ad3cf09acbf5bbc7e080b90ecc3d5741f0745ef36e424c90939bd38b799ccfa7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b602b56249c9516f7c5fef50f8ba8f46
SHA178ad5341e7b047321efe9649095a4e39ea955f80
SHA256615dc895d92b679c39bba18faef8860691f99561f9b4de9129ccf42c8cb6ad7d
SHA51254de94f02b7e036328df3e01432a05d2d92ea920b69b02fadbea6eb005ffdf1dad96145bf1b224aff603cb808518edd85b304788d224b83badd7b0dcdd77ee1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b8a1873fdff2c2054355ccf4444fbb6
SHA15042a957a0aa7dd77a7e84c158754b9ec3374792
SHA256fe1a962faedd77176a06cdf3348f9864f01a3df06174302dc0dc8436cfc42972
SHA5129cb1312119468b4d2b396444eb88782118e66869c0ef2f51d2d1824d535256a55b9db59dfeddfa28e38e9c287029fdfa216746439520ba3fc7049b12d586895d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c11d5f9674b419e656ac793634e2e3b0
SHA105497b9c2406c168df2d95418a69faeaaefeab79
SHA256301823ae4efa6fec1b5dcca29db662868fd7bf6f3cc6ab129fe07a4cec596f3a
SHA5120c3879263766ffad87220ce832484af9a92d7b0d3a28b552603191a7ba79780076ffdcc76962ee2bbeb80bcda621e633f6a9d384d260f271a97b107a859ee453
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fe04b63e2cfa49a41c611bbd0fc9e4f
SHA1a6a2c570d6914d4742ff49fa8512e7a084e91d52
SHA2569365566d6f24a28852585b9c7dc3de34c706b8d52f4033801622c77af82c6d5b
SHA512a1d8c67674740ea0efc8b0005a57c1fa97796a525ebfd3231b5fbb00ab800a7e16e314967384bbedfb4e853e59874a40465530e06dd26ded6c8520477549181f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538c69dcea65c7fe80d2255d1816125e9
SHA148fdb040a10a803061839feef48674a8fa5e9392
SHA2562d94e675a35254ac9c6c077392b64a5ef5658b5f1b5877daf9a1d48731764b92
SHA512682144efcc69f8d2ba3b2df678cd9f09113e87040b4a482105c2f6b0e317d377c81d795eebaabeff8fd7d893dbcda1f54069212a8bff4956868d43790a0ce37a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58530f1157702f3fc02be8ccd351e1883
SHA1a9c840d5b081d5a2b6172884c369aef8697a7655
SHA25623ca9226cefd948ddc354b4379819113b548b6cf8d8abd405c55ad2cf4b5e019
SHA512a81719d4bc0b2c9368bb179e0d3f3254ae77c31bc1654939e4415502462a37a63e538fbc86aa7eefcecece5be07adbe43b2fbf2b52d028ba94852d3336932eef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7b9c3fdcdf095b4878d5a929cf50907
SHA16dd6e7b307991511d9d434afe603967ef31d1ec0
SHA2567127787d0cb52b71710e2d02d3bb3d53264f05ff45dcd97f2b7ff35d20cb6154
SHA51239cc96d16ae738544df617de291c134e9de3cf54868248dfa1ac3e4a550dcd91c0420407072de59a8c168546238ef360c2e7ca030dd4f887425e558215bc1924
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5710517ba5543c6b948930760b4765982
SHA1c17649d402c1bad7f4389eedbe96e4c805e04c24
SHA256b77e6e5a9cf976094a348a8eca27e9253848d08e3604241a9332a596a424444d
SHA512e82a749d82e5aa5916a6a62679ef7f053f9976fc19383ee29e8254cff018a5434a175106e9602c66a6e83c30666451ff406045877e4528ff5e8852a546836b37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3f1e30c5b564d58a47862048eb6a472
SHA147ca522054d3d16fec50f6cee3c70e65ac960803
SHA256f6cefae333eed3068836d1b682c9df9d6c390a35705d003c28251d0b4d07158a
SHA5126e98e86b20fec36cd24f4a01c7e295c06750f21ecf5d35fc2472048ad4c57844097553ccbd613b521e3146e3097972ff57a1969a30d72caf1e14465181f7696e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59988b5d3c7f54253f4918af4d1c187b7
SHA1e4f54af6a5c9d2d4be9fb4392dfdabb954d59087
SHA256fb864830c0100fe9231e8e35973f10584077654446fefa25432dd3c01b0bea39
SHA512ad869dac997fe8c734ec73249b76948ff9041be9e695e4efcd45c1e7674fd7fc3121a8febdd58dee28a527f31b701f70706d8fcaf8c585c3b8e1bf86a968b474
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ade288cab5afc105fb9cd6a1b287a701
SHA18797bf19a22242ac787e0c8c933ceedf7a99cb21
SHA2568dff9409bd920b848311ddd366f96bca3dcdf1ac602dfb45a6ca55b9b11e74b7
SHA512abfd9ef5f8c93129936618aebe659b6126c2826123a4f5e80746d96e282249cd11e8e5e174e7a65f330807af7999beb496ab85a9c3bff5a40cec9c2913d35c3b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a