Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 18:11
Static task
static1
Behavioral task
behavioral1
Sample
7a0b57dc78ac266794ea1fe5d524916f_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7a0b57dc78ac266794ea1fe5d524916f_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7a0b57dc78ac266794ea1fe5d524916f_JaffaCakes118.html
-
Size
565KB
-
MD5
7a0b57dc78ac266794ea1fe5d524916f
-
SHA1
a208da6793eff0f02c40baf6945e0cfb0ebd691c
-
SHA256
b6d24999956a2c1c54ddae25228d930995a9321fbb2f2b417d9e7a6e6495560d
-
SHA512
230ecbcf34534c3b4157fb4cd485893db6caf3d9d730876f3cfbb1fb755a05ed592fc1997420053ab96378551ebe5ddfd3f9d74443799748bd555a4b131f9ff9
-
SSDEEP
6144:SOsMYod+X3oI+YusMYod+X3oI+YBsMYod+X3oI+YssMYod+X3oI+YpWsMYod+X3o:j5d+X365d+X3b5d+X3Q5d+X3r05d+X3o
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0f9a57161b0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000823e0350b7a70de8a7965e7796ecd92ab89a502d05acee5259a32e0b543878fb000000000e8000000002000020000000b41c40192bc92190f43e503c60c944c563b716ade0e76085df102cf1aae4b871200000004d9eab80ee448106ff1c8435961cff9b27acb6a629574e04c67b516616126e06400000003bdc9af8903fac8a8512e36295418ee47e657a8844322beefd62b4a8c0161e2227975a78eedd63ad4244a5f506220d22193f74dfcff9bf4cfdf73c1cbbfe020a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000003bd3fd799eaa9021133d53ce61cd5479d94bc4b1fed89c65d7ec88f554e2f23b000000000e8000000002000020000000399b5ffe02d4d0de1e03d2f787a7725494f7a1b1781b931d34c81d8b6dca160e90000000f2e28892cbac3556455c97ebc369c16aea691c09bf621012905f60c76a89968019df77e5da5db70efc0770f1450f655af114965246127b1e96c898242571d9f6b002fded39c4964bacd1441e7b53dcebcfa8d7ca5b9d19ad9bcd4d0e287a276e7fa171487d5f14cd1a6f588f757f85df868dfdab9478c6532be78b9ba851589140885df3c31cfd59d948e25f2477ee274000000049c7acbbab72617d61a3e751c95b0e12ba8e321790de33a49f4f02cdc96abba06f92d047e63b50b2abd44c062c3c1a018a576bb08208cac4d6813ee242ec567a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422995387" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C1D76F1-1C54-11EF-BA8B-4EB079F7C2BA} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2236 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2236 iexplore.exe 2236 iexplore.exe 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2240 2236 iexplore.exe 28 PID 2236 wrote to memory of 2240 2236 iexplore.exe 28 PID 2236 wrote to memory of 2240 2236 iexplore.exe 28 PID 2236 wrote to memory of 2240 2236 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a0b57dc78ac266794ea1fe5d524916f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2240
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c97ee39852629c8f256de77ef5adf46
SHA13347c7e375ae5374775e6fbe1e5f52d34f8ee958
SHA256c227d30751b1b0322635d7e0f9b6be9febce921ca71cc0b6d41c4f5ed52f0f96
SHA5126f82b5390b4b5b2fe3cb9c80c75903e669f938eba765400c7c579516011de5d3828e1f6d283a019d380fc37a6ddceb3bd499d3d01eb09736c8a4eb2f2611e232
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5757ec9be110ac3a15838f79f2c05f7b3
SHA1a0217c167f821dacd3d10dd4353856952ad53df2
SHA256cfd8c440f107ac073924fa8a7fcc20f7e9eb7cbd529340a0b7c6d0f972008560
SHA5125fb4b6ed3a832ae74ac2734c8591febed2dbe06a376264dccc5f55d5b7cb0f1a51e8b0ab3bb33dd693a943d369fb440b1c5c5fbdf72a655833827ce48f279385
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a2a9e899dd597770b3f6087c32af636
SHA1deac7adcf039cc58fd400a6e3c355e53a8d54d70
SHA2562171ad89f5954086bcbbd9901bb8efc21401434be55e1aa8035c6e82f0be267e
SHA51292f41c1348cdce589830490f153c1c73098df8f246da9fbb633ad88e4c166ce510101cf2baac0ff861b9093454e85211b2acb53a47f9ca8fb1bc66a0dbe6f7fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596af09afd1f374498068a7f8b5ab8138
SHA19bc73576f85b250937dfd2f2b0ca393cd8682c9c
SHA256c510df28fbb7bc02952cdd76f128324e01f130f743779ea79de02e00fe4f55a6
SHA51208111ff7a2b4367ae5ccecce53161a8abc8104951e17a58d4f729b04d9da95883a0439b40d215734f89c21ac40b524e1a1923940cff098dece4a71efacd85dad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5131f36727a814256c5d3db32fd3eb492
SHA1f431647a5f7f7e9ffd4b38ae68f35e8687dedb24
SHA2569e8ebf7b636b2b8bf1cf47ae7d46b20d72c48b227ba3b5cf572c49798cc86831
SHA512baf1e64279c4952e9c149fe9bd5f6fa20f1269476e7a903cdb359cdd495a2169c924a2c34886da265c7ac46c35c454ff10fadead48a9cd5db76165ace78b1416
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5668daf64d66d14470d952e6bc85de3cc
SHA1d974ae1b63c49d26ef803a233eeb4dabfcd9941a
SHA256e079e719adbe8fafad0350e92e39f03813318997116575f6619045d37dafc10d
SHA512f3c294f7fb537851f3e5ba9224a8e47013561c9b2fe1b5a27b1961c343005db00c775548d6b3db665d2872521db2c37677e7c02990c8668e4799bed87753a938
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51719c4ac9af0b9efa4db457de5916aff
SHA184fcb48ef2f03a724746c9fe24248b0847ef06c9
SHA256e65fb904f968df0a150a6bdccc926637d912d14b4f9e7d07f502467b86e44b19
SHA512a34cd84fa2c7a26a36781778c9cc3f863cbb6fd2b6bda15feccf389fff0002177a656585ae227ef9b23b55e41c510d46b821ea59cb44fa8252f2d71c544f1dd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53cc6561128b1dde9ae7e4644c6666da1
SHA14bd5be28c2df946c9127ea343061a5a2f0194994
SHA256aaf2653c7c00d3aa8368bb4b479adb23e6f7a807c5f5cc99f281bba6c597ad14
SHA51280fb52e07de62d51b8c464649200a22b553d8f4e72373545fd502452d31b0bc04dfc127c887fc50b8574662ef6ab6b799dcddcc118473f798c6f2274447fd142
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a54dec2b6a72697eb89eeedf5cd4cb4
SHA169c09e141359301087b771d5daf37dd044e37158
SHA25655e8b1c30f47d07bd13cb9647ef3d6203bc00bad58def420ef9914e1e9f22047
SHA512523d9774d47f340aa7c57ed2b4ce8a89bd507b949847425e8237cf4d436b3c6fd0c57105295fd117c0d82a757afc7166552f85af7d11b5643f67b1ac31f49daf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2b92e6e00d8f1574a2ad66266aef8e9
SHA1e2b569a337e684b21425a2881f75a96adc0f8d08
SHA256116f4e97c059c0f980a28c85d9de2936b991943675657ed87c4b6f7028315e76
SHA512c99bd51f325d5b760fabf6dd825b56dfdfaa79fc7be71e88ec1cb819c2ad5f9e991234d973d21bee6ef258173edfe0a84d59565bca6e876de32daeecff61f311
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c68f8936f7131ba3b02bda9d9afce045
SHA17f52accc661769302f76f74d270f5d17ff63f070
SHA256780ef86eb1e83c850cc1f52d9c3fff37e4c429b11491fabfb3f6849b21a4744e
SHA512742674e89132fdbfd8a688b2054f187cbf82000f7504e9e84366cddee25f868d9c47af9fae0472e017af12e1d19eb7068a8b510fcb79a8af19ab7d7febf6b68c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527c18780dacf8d3a9b8df2269e2c7277
SHA17081eb814a78ef5d73e4c03425cdba5f4b7e4db1
SHA2565bf73d85cf25f44979ff67e2442707328e0c8d85fd189c42ced14b73ee86c870
SHA51214035583ebad372d9c7739e7c298414ea0983f19e842fde2ef7c3348f22da41676585f6bbb2d2ea739dfdb8f44420865014bd48a73c3c47992659a8341b1bf49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a147e3feefe2296e2d2d63dbec76b52
SHA18fc7b478736b31d4470d7b24ec8b4dce37dc6040
SHA2565e78d345576e09274cefb6b1aa1fc35880d3de94fe56306057ff4b1ff4a7c876
SHA512228bf39848c9b8198771b36591b04ac8c679877373f26f78571aa4863615d875106e94147aea509d12582b1a53557395c2387fdc18225463a406552d3eceb2d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc76d9cd3c15663158e6bda51002c8e3
SHA15cf727ce4f5ba669275b576af4c4528b0dcac370
SHA2563aa664bf324ec9a182e767b378b136e3b6975914ffdda52e41cdf9b8fcf2aa84
SHA51202becdb1b1626d2e01cae59f777f480eb38756b6bf2614076934d693f0010f908e516599e515e70b0aa22d84854beaca2432d43ce34a8dc089ea2b85de3f9355
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db7d9a982ca467e62476619e42c977eb
SHA14ce9263c04054aff70d2fae934bbab573a373b94
SHA256cf6f6732d4d76e7e82b200d58d40418118351389c5edb7e7a589958a4a7938a9
SHA5126a9cf87463cec22ad549d6d059de76bb1fa09f5ce217388457583157fe79801c620967306b3fbced05630acb39f31799df0cbb3af696f5eb6004bcc989b597c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5584072ce2a9d1f93813efc3ac7c4ea67
SHA195544acca9ab8cf11178270fca12f98e481d7331
SHA2562f7a4acf3b451037db4cd5b8470097e18a24509b3376293b5f21ded0f2c01772
SHA512d7b247900260511ee33f05a4277d54d2418c3776d54bda798b7c347643fc2599614eb643ee8221ec6fa23045916281c180138a44b85406304efa4188d709fe82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6b6e119d9259801602e69c3cc908f05
SHA1f345840aa0feacffb68d95d79867257e97d4e5d8
SHA256eae241cdca8aff7554e12b762fcbd37803f9a4c7166eb7be551f3ce92b60a7ed
SHA5127ffb5314321b03738c8453fb88aa9868559e029af64f1e69f1bfd876d72a723e5dd742b994369fc0268c62cacf7fadd1a9dc5413e61f67943d85b20c1d45dbd8
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a