Analysis
-
max time kernel
121s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 12:52
Static task
static1
Behavioral task
behavioral1
Sample
79397c37d7dbc10e860954f95093ce1b_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
79397c37d7dbc10e860954f95093ce1b_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
79397c37d7dbc10e860954f95093ce1b_JaffaCakes118.html
-
Size
118KB
-
MD5
79397c37d7dbc10e860954f95093ce1b
-
SHA1
1f2cfeef7aca70f725567c2569b19152a9a18d8d
-
SHA256
a08de6bba2ebbc7547c7f72888580370b55357a79d5b4015714740cc3c9f483e
-
SHA512
ffb3fb6f1e18a241e88f6cfb496b9f83b7d02a5f6d8bae6e29c245436c34d5de44314865cd15a1b26d589d7a2d3e2e44c01c555d89dd33325836516fe6d52c55
-
SSDEEP
1536:bOJ4tVvwF2kGwAHZHQhFhPBJAS9KEdTiFG9OJ4tVvwF2NOd3Xm+Uf+QWYEAM+LTT:wMQYrEcjmx
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0C566991-1C28-11EF-9F01-52C7B7C5B073} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422976250" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb265fd966ea3248ae34410a6b2b7e0800000000020000000000106600000001000020000000f8adf9e0a3c4c1bc864916b399cdf07d9e22edc447eece75899501546a471305000000000e8000000002000020000000e847d0e980c7bac5f653117bda788b0af9b7f459938738bdca8560a786e32d9a9000000093266bd06a9b0203e3ec4ff4ac9068dc32c334cb86bb8ec9b4cd3069e8be382ff2311e4256500c29feebd0bfce9d14723bc0a53354a989fe05fef4a16375ae25e01b800c79f259d35dc5ba9bbc7bd3fb01575ea5d31f74bbb67bcb4f0e4c022e10c20f196b4897da215b8ec82ce0e906baa0c5f0f5b8ea8712c4373cfbff4f3bfc4353c6203f6da54e72313750e1b0ae40000000fa2e0914ad25b67c32d495e14f940fb6b1901c052b4a4511536e7ea7a4aa974de03211937c8f021161031dfc5a166f11ee06586184d04a2069872637cba6397e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb265fd966ea3248ae34410a6b2b7e0800000000020000000000106600000001000020000000cbf22115b52c4f8cd7c66e2cbe6b3ce18e6887b3a1bc3250400c1759387f22aa000000000e80000000020000200000004a1d1dc2034b2701320e046a115f94b230d7e5cc4e4c41697926b40959da6e86200000007aa387f508b16ed2d51ec91a7c3cda19f5ebd2866f6f102ac5341a9a88416d3040000000294cd3fbcd642a5e59d4f07c510fcb883a36cc1b44055694fdd7f87ba684a3a47b8a5f6e9e98e5be78380f8e46f459c71160d0e1c68ca55a75ce229d76bebe8d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0e689e134b0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2756 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2756 iexplore.exe 2756 iexplore.exe 2868 IEXPLORE.EXE 2868 IEXPLORE.EXE 2868 IEXPLORE.EXE 2868 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2868 2756 iexplore.exe 28 PID 2756 wrote to memory of 2868 2756 iexplore.exe 28 PID 2756 wrote to memory of 2868 2756 iexplore.exe 28 PID 2756 wrote to memory of 2868 2756 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\79397c37d7dbc10e860954f95093ce1b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2756 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2868
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cdfc8d68704e8143b21e66216705c9fe
SHA16c4ed92ed4d8ff0e121b45c12b9f70b49d0e7291
SHA2566c3a460b10feb3b1ebb2044b7407effb77a2e40117c53a628c26257560324873
SHA512c7441d8bf0e89425d4fda2e51c6d8ba58388a36c42038277d3ab2eafddd89ca1501afe4f27f7d1481bae6b917557d801e8c0e20137b8a698e00fa4958188732b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5addb59b6e633103b3d11a1576d2cbb84
SHA1bcf888c183ad9ea0fd5b06bec9e2f4b51e947ec1
SHA2564260feee57ba10cddac45395f240e74de59b2c80d226c25dd23c4d552c6f3082
SHA51249baaa04c6d3e08b8b103e7c074e2fafe25a65c719f17d760bbed744933f29f034dc16b54639814bb38ed19604f63af3ce0297433903903a1dd01c9d287a0e23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e74f9791095a324c60447b9c0fa56dd
SHA1f5b19f55fbe0177db369ad2c8d4055a0a02cd394
SHA2560b95f2e02c0d680e5a867861e21d4965dca75f5a69560a1303b0dbbcd6b675a1
SHA5129c77be498e610ace202c406cef94afb1ee1be0c14b7b98747260bb8bef2b786f20da3bd78fcda0c36f3632143693b0ed476cdfaa75f1f0724f5bc35f28b297ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ec802289331892dc0d8089a1aece8fe
SHA14e7effa4efa32e0ff9103fd0e01e859db3504db8
SHA256feca2bbf852cb5aecd794787673c690f92cb8774cec7e6571ab98f1865672baf
SHA512bfadedb25701b7185814b6921e1d65b6c4a3b3e46cecc7027f504309769df1adc94378b72b508140155e27a0f9f206c3b9f8734d8cac12e3dd6192ca2cc18344
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5814cab18851a1ba03e76c0550c193d35
SHA182be4e5a203554d234537461ee59a885626392cd
SHA256bdc59b07443d746dfc84619bb4f06c273a97c4a2b76155f27b0f91c7d79f0986
SHA512cdd546698677d792feb05675b3904fdc4084e53686edb9af0aee85b4ed1e8a297bd77d8cb46c4da572e79b924987cacc933d4e677cd9ce59e26d03f0bb44c0f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554811ed51347b4424ff644cddf7a8942
SHA106b3be7440d290a24fe5bbe179b456bf26f5d981
SHA256f899a95dfb12e8c21a2c694444362d4df99feea318fc1226e14da2c43386f4f7
SHA5121da0351ea6c69ac1993b6c0a13e7d6d0d8e2d5ad5cfced85a078bb9fc0f13f41088ac8d27a63ce79917f4e08303c7614bf05667f2f029b5e2c6bf3060f7cb4d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fdd92ff25a2f6941c3c3d575faf62a78
SHA1bee4b91cf69eb792b684cf833815ad30439e1140
SHA256876775432db490016cd49d719e525b02a7e2f6876a0d4443d0f60c047b38acf8
SHA5120e957404f76d7fcbea9c25cfd54e032b44a5ca3fa618e9e8243f7d4e1fd0a27ebecc2704ded3fca0cbfbd42cf3ea91493374613f275a97e436a40e7b068722a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5505b9583d60e8c5d8515cc0c25244dcc
SHA1989835cebcc9b62dc7def8202b86b79c08ce4bae
SHA2562bccc76109e38128dc42cb688ac7a5ccec352e8da6475e184286981f16321eda
SHA512d6df1128f583c23dec64aaba5125d180de961d4087b21e7f3962e6d0660c99429b4b337a513d493346232146dd8cb6b12aa37da2dc36719293766ad17359322f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526fdb3deda632ddecfa54e387ea93702
SHA1e513ea5131660cbaedd415428093d797e930cf32
SHA25621dc01fe4dd0bc31dfd9a8277511799175f916d2cc44e853fc385614638ed2e5
SHA512cc1160617e74b51183e9e18d39dae0402f44ff47eaaf6efe0fe563a7cc587f4b28635d57c81dd8527706c9f26feb408db5b8aaaeea93134c4c23d66842da7cc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db0b2b1e4b906e17b6489ef83c0fba19
SHA10db300879fa5c1e9d6063369f39556c9200a759e
SHA256df13a23f6b20c125672201dd3656b71c59013dda22751a7b60da612381df07dc
SHA512311f5f1356c7133fd37c8c937493e21a4c459809851ac75d00bd25438985631bfd8105ba7f01a58102764de8a78cf749b11df2e2bcfcbc15185c61c5a0562007
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4e5545c36eda4951f7b1d1230f16e56
SHA105df8c1fcf1dce32d5fc961a8c215b80349479aa
SHA25639696c74120b6f62c69a0595b46dc206d5b7580644df242d7728ae10bec46dd1
SHA5125d7807241449a40057ea75a033f1c57a28fc3fd8e60c892cb2973b1597b897ec3fd97d6d1abf6223f235fed7c5e9c6ebc88fec2ddd5b6c3a354e1cf524ad8896
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad0530f879c5d3b7c8158e08f05dc670
SHA1ebe1e919070932e0cff8a59aca80af268161ee6d
SHA25642a53da2c0c058883ac4c8961080ba0f9df2a3dcc25f277cf8c8da2834c06949
SHA512e586afafdc93f1ac3bc5b500fa3dd6770d53825d4e691f09b724d3569a203db83a01f44841667a29bef5b32b4e4972621c4f6f90f700329dbb390c2aaf9f408e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d11b80c6d62145dfcc40e7f3dc3346c
SHA1f071e39df03a6b17e0df7770cdedf07544b297fd
SHA256d39db22b0e8a470980f2f245b967510e9df6c112abe64a3090b0fd9f2dc7c43a
SHA512b9e33495dc5c86e979a576cb16e9d2117e937d44f0aa445847e575014e28ba8b565aaafa759510aa697590fc2577987f7ab9b84dffb72daf6c2d1d252af3b025
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c11c269371be497dd0da01165d1fdbe9
SHA14434ef9e527ebdeb4bd9bc9b3bc21f7836d99fd1
SHA25657ddb21255190e9c956bbe11fe62f8cf9eaddb8e66ee60366a90b79c36223588
SHA512b6977980de38f80d5ff17800da445282d936466d2d452e67a8b53d7d8d612b7206f0d6c30eeaed9e3843511476ef9f57ebd6bdd26ce536b35503753c1159f6ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b49b120bdc65a60ad0104f2cf9863da4
SHA18ae9c92b264672cbd72335af0b161f1bb7a8a782
SHA2561397b204abb84321701a10a73a94ae1d3df8761df734be8ba3ff1d02605c7071
SHA51228f940a1f4e30ec0455e0cd68d23c41fcd5d20b413056934283e4b6cf1e5036ef8853c34ce52ce61af86f9e585edea57e107aed61ab7883313a2219941f88ddc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5add7b98531729d40716b632f68dbc037
SHA119bd2e386a0473570f970e793917140dd6c8f3ef
SHA2562f0678a2a876952875e867dc4a470c66fdd3cb3aac3c6b1c5df0b6a2a51007db
SHA5127c7a12751bce4e7845468f0db2fc7833d9136c320088ab920d52218efb749790d0cda0e883c0965ef684d1897f2cc72059508898342f71409a87fa30081846f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfc0ca912e50e6e2515d693d3c4113da
SHA1266d1c6a6494cd2cb9c1da31b294f5be492a2e54
SHA25684c68c1bde891c9adf757112fd191d07cf4790db9f9949a1c0f1c507d06263c5
SHA5128eca503dcd500832a22e49dcb8f20541d8b014b6ccae3cd7c078b130a91510c5afb74f6bbc65bee598da21bf52875d4569741a877b472d837e48c5fee2841a7a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a