Analysis
-
max time kernel
137s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 11:35
Static task
static1
Behavioral task
behavioral1
Sample
7ccf81ba9c73addceebc4d9570d1f910_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7ccf81ba9c73addceebc4d9570d1f910_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7ccf81ba9c73addceebc4d9570d1f910_JaffaCakes118.html
-
Size
14KB
-
MD5
7ccf81ba9c73addceebc4d9570d1f910
-
SHA1
ebf9faccb8f243f7d3daee8525e10234fe7fd985
-
SHA256
d6034e1c8f0bb85a351a8082aa0ee02345169ef322bdb58a2a92283546ec688e
-
SHA512
b82985d859cc10c3182e479c300b6c209ce8412ae263fc04d51420b8d888e5d57c11e0ce45701547a870f6e010493cc0ad82e73e2d724ddef2d6ce2df080a238
-
SSDEEP
384:NlAHP33hWKfeSgYoroDoFYeVACjf3FxR+EHPGhP8ObPaS:NlEf3hJ2SgoCznR9PGhP8ObPaS
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6AEF82C1-1CE6-11EF-99EB-F2F7F00EEB0D} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423058010" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3056 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3056 iexplore.exe 3056 iexplore.exe 1272 IEXPLORE.EXE 1272 IEXPLORE.EXE 1272 IEXPLORE.EXE 1272 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3056 wrote to memory of 1272 3056 iexplore.exe 28 PID 3056 wrote to memory of 1272 3056 iexplore.exe 28 PID 3056 wrote to memory of 1272 3056 iexplore.exe 28 PID 3056 wrote to memory of 1272 3056 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ccf81ba9c73addceebc4d9570d1f910_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1272
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531c76532bac05418ee40d02da85daa7c
SHA17715515171480e16c176ff5de49cf4aa019d8a46
SHA2563002024319246fc1c7dd19ab216e8d04edba1dfc87a71a40de478b12a1d52711
SHA51293a6eb4646260d88030deadb5d32063747ab740981554f62a541f111334918aca45085cb69e5f59aeec8d7b313ca5fdd8f74fa9b485ebaf355b9d7fa5fd7d80b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5682e16e625b06bab2bf6b21fbb890fc8
SHA1eaf22b2e3c5c8e9b1ce4a6d064f7623dcc712d10
SHA2564519ae0e0d1468efa2e5b9f26e601025cad179da6ce36017b9a0b17015908b2e
SHA512f3812631f8421b23939529f15935211217b356c5ba94152ce33528b69bf0e1d92d18b2cf2abfa1dcdca4e76d9e83ccf830c61f49494b2fe78f127a80d9390112
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5224c730e7e561b9191502ef3b9d99a65
SHA1d29563ebf4cb42a5e2eccd614a97eb88201adeae
SHA256be2afdd5abb5b050ad7460ea3b24770f6a2333690f5b7c00a7f5c7ddd98f7d3d
SHA5126335eae22f29ab5e987dc17460e4d07ee6ab7667a84647af99ab548fbfc186deaa18b61aba927e87ffded1a382a9bfb97ff1f01649e170c0e1cc67fe8283ddaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f07b4709cc04f51895f2dd7cab6a95e
SHA1d7611d793dc5fa44f587b41270f5698a55e04383
SHA256f28d13f405132a298d5c58ec85363d001efb60b644d455a341ab73f09978c43d
SHA512cb83de0b25f7b46f00d947c1793c697a47dcba192a931a36a30547384e7be8c4f807c300b309acccbbb18d049ce03af0b3b3c887463632acaeba6ea6d98a2fee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4842bde74c9c72f9714c0c2e69549df
SHA19ac6952c26b7286a59573a8fb1511136817a9da0
SHA25656c8b12106cf7c41dc16b01de8553abcadd768f8164fdf37a2b803de17da5af9
SHA512838b8b2340788165e82e05d8e804de87cbfc6ed08ae9a0726db3cf4577b73b68834faf492287957f50e356151cfa8eb0214f0dc07b6983ea888724d37f582e55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b2ea82431835be4c2a11862910c4b28
SHA10ed990a3d13c680706b636cfd88be37d5c13dcc8
SHA256c45a8feae49eb497a25edcc1ad5d1cf1873b9839e17ca66af8d96e022d2c6c35
SHA51271dfd728cb76e521f7acca9a7af847c5a6ff3c428b07528bc918da5eddbfde16da9ee10b26f2a9930f22ab1b40a29529b1f3f8845cc250f7ec6e969e1d53e1ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cab92c151105ed53d6c1a172ace1f5b8
SHA16bcf37453af333e93c34a9d7eb9258f1acdd528b
SHA256214a68a4a5dcf6f7fa050b0a1d4f74a0ea000167feaa8dc43b0ce11fedf7922e
SHA51286404b7a07ecd5f546ff8573401e023b42d6e41b383515b42fbabcfc8efcf26a6fbfde7280afb4f627575aad8832b8bc771d5cc4950fa4f40b3e641be8331bdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b25f047e0b6feed352286be9f10038f
SHA11b5796f4387d49ad12953c42823b26a78ff90a48
SHA2563bc03eccd113cc13c4663bec07c7920c107509a83c3f0968edaeb57185532e7c
SHA512ffaed25a48df64d872ae2bddbeb1fb9808391c37df9027705de9716224e8941325c20ad0b50ee3626ea36e48aec3381250e7f2c6946dd6818abe14c66754cf78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54897c58a24fbe415835911d4e092f804
SHA1cd91f14f27a663aaea20971d064470120142e6ff
SHA2569ebb4b05e2e74c34943244a492fffb519b67ebd26d6c630a6098ff7116b40394
SHA5120ed457e68fd1856f7e0b2a4a430ab59c379d953893d7edfa25d57b5b901165536e803e2ccf8dbe31e6125b37e2da05665415f313863310ba6f82650efade7b3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505e6208798848e40050ee0952ff35da1
SHA176cd5abdfd28a51b4b63c79e7e92ddfb0e86e46b
SHA25622365d775cb20a9a54d7b8dd6d5d59b9cb10d8123ff9d432d407d14afc8649d4
SHA512526ae0649917e9a2b81894943617ae7298be5cf0deef7bd1e9411bad2b3ad8cf1a38b6c38db384545016bf9bd5f339b539ebfed3949ec567f3a721c3cbb48a56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fc118130bb92e5a6e4a2422816cac4b
SHA1457b7cb542ecadd965b4ae1fb4a683bc71ae112b
SHA2567e3fa4ee0bae49bb885abdf80e7466b5e76d9ef8746555ccf144936b14c05584
SHA512825a379874bf4c56ec8225b6d5ff96e165d80e9e20fcb860a74fdbcd214b88ff24739e0b9e939edd33f44fb648ee531ef005d98c9eaa88cc585e6b404c0f7f2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50733384a17343650d8e565a4520acb1a
SHA12db29351e054d4dcf8446f7178c2daa188fa239a
SHA2561fa85705d67b1fe28f3ca3c39d0dc71c4751c282ff0fde3a7bd718436d14643f
SHA512503804ae867a644e0f025cac04208840c76c363dad0cec0bdcfc092e25b499f724b7dd02bd95ac465716b45882d9eadc2e2a0abc59df9c2f52f30a704ed6d30b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5445b96f51bbd377df07fa72dd965f5a2
SHA174c991c1511a5f102d5705b5e693c28715f8e709
SHA256b94891a198d9cb92bb21a1f33e3870fd5e0c759352d0dcf478ee52d0d47a9c65
SHA5128d9046ce83f46b67a852d03edf471dce07f5034bbc46b886f2323eadb55c4d67256de0a756d0bafe4da858ca68f5f3cb4dca98cef01328ec22e7a2e9fb4eba44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512c897376e53f9b1d06023673218f985
SHA10d9fb9105cdf1ffd578622bda2b6c5220379cdf5
SHA25606554d8a2ba284193cc63c66fa69fbc099b217fa0af90a1f0cc9e162584b4156
SHA512ad70dfe53b3c6bc1db78068dc63a1030922f556e29e95d36f56178cc05225879ea2f580674d6a56d4ac034b70a9e690fb7cae229418946e979dbe2f788506ce9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a96785cd3adf4b11b93a59f60d3fd1ed
SHA1a7c3e9bc85cc8bf91e81105e9450671e6b6516cf
SHA2560550a5e8de069b6c53d5f0bd353ca60246312a2932d8931b764b9f58693c7a92
SHA51207cf81d8961de9607de143d0e9c1113804bba332aa8fb9a2eed34e7d9383aed6d0b77c91eca15b255b312e8feae5db00d6328d8e9726f23815ab28daeb646534
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d52698b99f66570efc7e966d639c3d7
SHA141a7522788f27369dbef9dce20eacc3ab50ecfb2
SHA256047cfeab24a173c33df7c05619d3a9ce578ca4d50d63c669644e90d08476ac77
SHA512317cccc19fbac75b7874cc6ac2284575bd1e2dec0942b0f780132335c1fc4418d2fc50af51440a3b53a3b0d64113c167d6d07719c1be3337d60dce40e45c8e2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526caeb7b05aec3543811a21d4798c03d
SHA1af97e333ff558f1762635c91468b354fcd6e6a67
SHA256574b6aa21e4129e193c8ffbb05663b68a508740d49ec0a63681c7d71ad721d40
SHA5129febf82ff3da3e03d3a4ca50cc60ebecd4e6616caff75429cd706737d8f0598d85cb726fcc7e4cceb34c6fe3ebcfc5b0733b860360f6170dccd2bb858185501d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d3761ed2b32cc2db84c28579e2deca0
SHA1d83ab4a9a4a23b568be25bd939b9b9335a7469df
SHA25680abefd01b6f3b3c07f3708c82a74f795e09f37310f206a47326c3e0ef788092
SHA512f2c7bcea3abfd0a3d60b736357e896564434f30a88d7fee8d0a1463e855301a8bbca9d5ad2785f6d9529a20e2f270fe0ad250a13dcf985d1c804b96551a9b948
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b45855c5a2ac33eb54820ffe9fb925c
SHA1df2d0c7ec727dd9ab68526e75fff750cdfa9b85e
SHA256480da2aad07a95ff5d7784966bffa9e5cc468bd5320eb613a477ef6df5dc75c3
SHA51280e13f02ccf13a91fa7a83befee56e577a68a0735b7d8b65c293e14dd388df7bd2c38a4479a25f147116cbca7e3e3e9ec89b35b1f932a4497e62e815970745ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea090dd452ccf373e962e50474bc8952
SHA1475b958a41b52f297a06966184c09f9efd50f4ef
SHA256b1250f787c7cb82a090a9ff6c02b5e0df89b183e7da8ef1597680088cafbead4
SHA5129d48f1f0d4ac54cd5d358990e396b4f2f88142cc2adac22ef40a4a464730fcb9a481f48d6fa8eafa0a10d5fc352e381393e8f40687492ecb1b943c58fc9de604
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50dec80f3a61b29b163da6e7430418a94
SHA1c0e75578298c3736e0fefb8114a90c2eb712f31a
SHA25648074cbe68b81047ec30549bcd78afea340919258001dbf150510b67bcedb10a
SHA51279477a307aaece8bc94a98296f194a152d6bfb6af5fe20c71f466dbdbe30452dee27d3020c205eb5cf72b37ba513575c9a9402578c0616499d13e6d86f09d571
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f14c7d0e8ceddb06b20f78ce694d1874
SHA1f2548101bd6ee9d1b2a55b65ed3dd9a967a32dd7
SHA256fcbd590d25b958d452439bb1454e64b9440c3c1a24f0da4077b74540480cb8a0
SHA51273ac2e13d736f4d56ab5e809d2d11c516003ac80ec13edbe6d5e33b1ff4ed6a7f74cd5e85bf6dc0390fba562dfc9c4592906fed7747fd212fbfb3131deac5f16
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a