Analysis
-
max time kernel
139s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 11:59
Static task
static1
Behavioral task
behavioral1
Sample
7913f0ce458324ac2436bcc20fc13dd8_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7913f0ce458324ac2436bcc20fc13dd8_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7913f0ce458324ac2436bcc20fc13dd8_JaffaCakes118.html
-
Size
61KB
-
MD5
7913f0ce458324ac2436bcc20fc13dd8
-
SHA1
8adb0808c8e59eb82c146bf63808098bc8a7dd74
-
SHA256
a46e7cd147880698ae0476b6d11c0eca8fd2244971954d227043d3a655270ebd
-
SHA512
ee9592b077cae871ea7488208406a53e9982df64b6257c3b86e22be27cf32cf7f0b9936cc731503a3f357f638d6847153fbf792f0bc40f23ecef3ccda52f5976
-
SSDEEP
768:JiegcMYUcXGeCSXuhD/AmoTyZCZkoTnMdtbBnfBgN8/uQcc8QFVG8sP/Ijkk5nnt:Jg2RBTbec0tbrgamchNnWC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000073f847a0d806190f72878c9efc316d2e6748e2c23ffe39b958d405b676d2d04c000000000e80000000020000200000006e2d3743e7eb8a2f1de9484445af1ae4c6bf3604bf852b841fecd44b042ea9ea90000000bb0b6b2d6c75798fcfeb4d1c2ee29818b21a2ae2db28870156efad27b4779eeba01478e50f18fd5a73e372f393d023612f1258c8a51cbd9ebb160b0750efc75bc9a6567e00b7c0e8436e5cbcf66a346a2d396bf787ab79b6f809bac3a269ee6f203a7098be645f626f28d36fedf35ff6738c40d857ed948b858191c66fbe0a32b57492f08666ce73038b3af8a152dad34000000077a93e0e571e788de4765a9f81e58884b011c0f9a6c0755bd758e3c49dba98f38999788ac2f6ef40276e851ed0ef7579ad1bf5c819bece13cb0b40f7d956056e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B58F1C1-1C20-11EF-81DB-4E87F544447C} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422973024" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000044cd82d155e22f0f80ce5cb2fcf6475ac53449d48c9b512893140301d44d5cf7000000000e800000000200002000000018f33b1e5841fb4c05925874f3628e59b71f978fda5dd201f6c493f0f2df64c220000000c8ce7de73878eada7017b1dd3e78fa45aca685ab3e76d574c31873a11be5634640000000098f371e901c2eb8e2b5f6a10bb34582a9807d236b52a1a944ecdbb69d7bb15ac7e477c91cbd6734d2713b86189bb574d70b096f50849d5cc1ebe9d9fa026b76 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40fa0a602db0da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2204 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2204 iexplore.exe 2204 iexplore.exe 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2700 2204 iexplore.exe 28 PID 2204 wrote to memory of 2700 2204 iexplore.exe 28 PID 2204 wrote to memory of 2700 2204 iexplore.exe 28 PID 2204 wrote to memory of 2700 2204 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7913f0ce458324ac2436bcc20fc13dd8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f92978014c7d1f689281d7c130336227
SHA1b0644ccf13a17a3b751ba4b1d13446ffa9b51cd6
SHA256739b9cb915026ae6a3caee6afe1f1d3952c91a86c5b4ab00f423f0a1af412cb9
SHA512e8a2d34f047936468b4a4303dca85366c94046f6e5f4bef75abf4663aa4f15ee194264484d181d786563445f80b88178792c77bd6d5a0f941df07730db1e9367
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501a55f8a5b8e11456a46635d7cca7782
SHA1fed908eed8b22fb263e0b73220a883ac507ac0fc
SHA256b3672d4d3df684a17948709c1d9b6f769274108c52e8691d74cf87007f816c79
SHA512e9de32de68cf30c69bf69858efae939d0d89807f4174ed3450ad47e66a04c1be56ad27d443f7dc3eb3eb044623b13a62fcb58425c80fbb74525ca2c8dec96cf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581d79791711c9bab8974dccda452e8bb
SHA12e0c74330af9cd64a8c863a173ff152a3c447560
SHA256ce7d51df86ff7274da51410e27187f197292225c0ab09e323241bbfcfe48588f
SHA5124427f93a2c83e8a1c31b0cceb429d8c03ec057248b0ca6ada78faca07e6a506968b33fcf3540a10f38d7ecf1b21d1604d93e42290f6a80d96de95d884be39d2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52cf8c96835800478435f7954b42f2e0f
SHA1403a86da199e5f3a25b868238a49517ca457c603
SHA256566d2cc4bc34fe70343dd6395ab46b8685e68889ec5fb9466589b23287bdba3e
SHA512ed6a9eab2bd2acc0c044002fd2537833b3176120db075c2d149002df7dfeab905bbbd173c93feb9b937976b892e868d82990874cd74c872efe795e32aaa600a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557fa076241e34d09c58f3405ff2d691b
SHA1f5e6b1a98ee96ba61215982d09c6cd397365033c
SHA2560e8b1c405296b1b503d180570464bab810ebf57af1eac851f9f6fdb1d46ec07e
SHA5124c59dd573b9bcff4bbf08def187e63b6ed08e2b35407736392259ca92d294e1c80f087b50ae58b36aecacdaf4b033a77f78ce793509394ae56ca04d849bba264
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f08506044d89127c049a14760702940c
SHA1069a147f3fca98c6a5753cdfd4f49e57f8831cdd
SHA2566b881b39052332ac3e9ade5c9e3472dec92ebf17dfc831632cbcc0ce4c204d10
SHA5126e77c5f97f165f3a005a4c2f1999e0bbf1403ec3ae85ad847853af4f65ceb96336ac239c5e73a38101db9227453e9a6f41b70206ec111b393254e61028dab0ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6402af945e1b559a1fbcf8b50d96101
SHA1166da59211253b722d420481fba30bc910286f53
SHA2563b1d8763ac0dc85928b5981284633489852715242cebff5a0ae8f6495366fba5
SHA5125d9ac04597ef3677b30549467bb7657c0f599dfca8449935afb289f89d2e246da038dd32c301b42d97e335aa546a79b0baaf9ba5f7b45d7ea544db3026ce0944
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9f1d55515b822cb8673d30c1b383aa2
SHA1d730ed2eb135d37c2eeb83fbfb7bf3752dc728c0
SHA256060d5e8373efafc5c7339acc4da2e1085e68d2ed42b7752316fe41f6a29c8c75
SHA5123e6c5d19eaa29ccc2cec0b0d0e1bb416ce50aa8d822deda5ca44e28b8b7a116d3b0424c0625fb3a68daa75f614851a5ca00e3622060b108c9a1d7c7eee66795b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7b2e99c401980e009af3cbb638b9728
SHA1598e0171b456c6f136bcc56b6c15404ccd9e4d0f
SHA256eaedc008ec68f18b7d41eb6159ff6011539a16d6410ea36affe9e18ed534710e
SHA5120676d18d95724801a136dbeffe05e4e9b356cfb70804941020579db60fec98d12b967be085a1dc4017fd3e0621ce98fdf6d216c0ec9d220b9c59fb67c60bedf2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab751f350b4de62aa2212ef71b97c81a
SHA11e5ba1fa7d2ed28e4f57ce3e14d0efdac3b47ce3
SHA256e19415bea28d5039313a99971cf775a181d978ad767bed6f717bcb3c5e39571a
SHA512ab930e815ff819d7f2331621b5da5028c657b5a8a1e6a9ea78d206d0f2d12cb22d7bbee91083cc28bdd20c20c089630daa74183d4fcf565bfc214e53cb0397ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a2603091f3e65cd613e52e0c1a7fb89
SHA18d9bdc6a2cf43d77dbc8713a1376e7c5be542cf1
SHA2569d2dcec8bc9ae36817c2a34bec9b9c7a2e3382f51a205adf12031082dddf6535
SHA512629c01dcaea3f001cee77afb5f788fe9431d38b6d1d297b84205254af98a449ff6dadb24bd1efabef85b10a53428cad8f3cd047dbf781bb7b6c5e5fa7b864138
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f542476029f6a5aac017d8928382159
SHA1054cc50287c21873720d10b04ec071ac8c6a8c10
SHA256c2436b385ba4dc30009bda5d0e422ca4faf6df05e1f6030a908d09e623c6dd94
SHA5122eafae9d2d89f8175820365213fc38e8513860ddfb2d57511501e5a3399e7744e42e97b06d6d6d2d2ad2c479a473b5756fb4eb7f880fad8c307723a741884cf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8d902ce6411310ef4250a5644310cb9
SHA1c20997cb12005bf1a2ce79788ac8f632c6e80cec
SHA256e46a57c9531583a7e034d238860302dbe9d4df2f0bac61a24196df28ed43c054
SHA5126aefb680f7468e90e250d72a9ff7a2a6d9e384eed56831f826016df61ff2997da4f96f05e2d7783371e1b7e826f5beb6e9b00c5c8361b715d5b7309dc6f9fb25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9b927f525990d634d518f70705ea71b
SHA1a6614155736114169757d398ffd35527600180ae
SHA256eb1ad2e3fc72210f01ea2fb394a5eece2be91e33754f61de98a1949d4c882e5e
SHA51220d3c2e22c7b3635c25377179b54f43315c86375f0a49a54df8a575ee918e9f08f1d4accdeacf667441b8d467a7eb61fd3e1d4bacf6e1fa6a502acc1262abfc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59bc285f6d8825531a9d9d14f708a8304
SHA10b4e81c3ab29861481fbcfcc604890104d36543f
SHA256027309a2178a9accc06b7edf03f462b9f08a979101809d3d01345bb61845e6a4
SHA51202097392293f840ba01195bc84f99e7da6a2920acb255f21f48082065a76a20e3389f1797b1e5b6fe200962a6490956315a918200198843e7fe01fa5dd6e5ca5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c82fff4cc786d6d1183500a1f261233
SHA1200cf9e3eb239878106284cc41a9d8178a8c566b
SHA256f2a21d1738d5f918d4e79e6fe08c1dcffc3f369f7785ee01eef872bf38dcd03b
SHA512991f405fe50e447abd7506694e21d3a9414414704b86adb32ce87a442fd6f016eaee02ee02636fdec1a40ce3f3c87ebd39baa6f0dfd18cb26c4cab4189526f4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c45096c78f1eb3f6d8945cb968554cb4
SHA181b51874a5eb8b27fd744cdf43c20d6ebfc362eb
SHA2561dde070fa90c2fc499a9c0ea3095a892a2a075c596aefdde19402f5b452a4a1d
SHA512f3a359e20bbac99085c3361b6f060cc848ae94d207f4792c7bc65ec9e001c3bd4910866341799f0514eb73dff6bbcd0c8f218a76c773ad1c9b70a19cd6cd7559
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5979917508aaa4371ca59717d456db869
SHA17a421dc9d78799481021a4df8ab529c3493eeb4a
SHA2562bef2fcb02a7476448c87c20c09986113128cfc5d6564b1919996ed4a8cbb840
SHA512082ff7952e18add259a58ce1aa142d9ed296cf3215ffdd675f97e3ee244d49f046d59f5d76940d7547c60fac38126dde9f62ec87f994906ce4dd64b88065c653
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5719513ed7d6e36712eab0832c01687d8
SHA14142f2fc1e54080261641aaea7ccf04ac6e10605
SHA256b01e885e62d5d45cf76fb2da4cc6775c94d87959208c713a6bf48dba1dca061b
SHA512e9126e20904200f231a96871153678c574741df0e474885a888183b4d9ba874c3cc2366d9af6398bc9fc5c6bc1161e76da630ee560a295dff75eaea197ea5d7d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a