Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 13:57
Static task
static1
Behavioral task
behavioral1
Sample
7d34ec7437bfa0cefed1b8992f68380a_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7d34ec7437bfa0cefed1b8992f68380a_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7d34ec7437bfa0cefed1b8992f68380a_JaffaCakes118.html
-
Size
461KB
-
MD5
7d34ec7437bfa0cefed1b8992f68380a
-
SHA1
a15ea16f02d63319636d45b8b0e089c7d605c9af
-
SHA256
34e96d9bf02415749a5587ba40bd2c3c9331866329342dc12e66bcdccf3fbbaa
-
SHA512
7db18857b52be7dac1143a94232e4ed424e2fc541e0955bf1f770f23833751826d11fc01fd7b6cc82ea164b9ab5196220eef1c9807064806887e45e106c05dc3
-
SSDEEP
6144:SQsMYod+X3oI+YJxsMYod+X3oI+YFsMYod+X3oI+YLsMYod+X3oI+YQ:x5d+X395d+X3v5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005b185e5bf409b940b7732c8b3532bc8f00000000020000000000106600000001000020000000156547a3c7f1c4722ec2ae33c1507285a9e342c8334ebdac676d8388371ef4b5000000000e8000000002000020000000ad58bb9e12e75135580f04e20fb7e25c08b5e3bf31272852ebd3049a451a8632900000000e884b43e074ae2ea7b21e5a459ce6c6e334d0d1b70e7a6ba1fb7dcd12e77732a01f382eff12213f4438e43dd4fe7bf2ee45c2e2404406a3ce7e2a0d4b182424aba5b36c850ddcd935d681082013255602915d22db5a49bea1823b75c94281d564bd4fb55ce98159333815d924d2f758c5d10282d63c29512185922479a71d246abd86d72b148ebcc4bd336561f1c44d40000000b07888589c6d3c7e4053bc48b0769421188860941d380687254c07ee1f6d2bae7784d5248826aa4b0efd5a6c08fc0eed3de11cfc0a9c9e434355faef731c1899 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423066527" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3ED467A1-1CFA-11EF-9371-CAFA5A0A62FD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ed5d1707b1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005b185e5bf409b940b7732c8b3532bc8f000000000200000000001066000000010000200000006103c160c28a15dc2a87ba852052a7ffa2decb68908eb27917fee7a8797d79ca000000000e8000000002000020000000522df3cbda8c25c3ac20ba583b7957b0a308dda4a8e2eaa93814dbfd11ae5b1e20000000d37525aabaebe4066302b7a5cdcfbee44dd579ef59edf0251ca5b19a7045de1d40000000a8d2f9b40220e73400e259f6a7208c481489752d74d3cbd181f9861227150f75c72064d6696ccbbe8cad16dc4ddce62d44fb9c39ad9d05acbc7ecd963fd6062a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1660 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1660 iexplore.exe 1660 iexplore.exe 2480 IEXPLORE.EXE 2480 IEXPLORE.EXE 2480 IEXPLORE.EXE 2480 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1660 wrote to memory of 2480 1660 iexplore.exe 28 PID 1660 wrote to memory of 2480 1660 iexplore.exe 28 PID 1660 wrote to memory of 2480 1660 iexplore.exe 28 PID 1660 wrote to memory of 2480 1660 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7d34ec7437bfa0cefed1b8992f68380a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2480
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f6b8482975bf5992c46b1cffa7fb847
SHA144de3c62477b5e9d050cf77fb3ae708f8719344b
SHA256599acc8a6783a4c469d6d2adebefd1a6fb55ce08eabe920630ebc6ff3398dc5f
SHA5121110cebccee74c715474fac1ff30e47e3629ea7246c1aefbd7b82b96b718ce298322a06290a3721dc486aaf7ff77718d18dd771bd0f2c53021590bf616459b27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50dfb916ca8bf825c59bcd1bdb951187c
SHA16c91dba23a0e2867be151adb95c06944ad0f5bfc
SHA2568b158adf70dd5a50f91064495b809ab91113f1dd4a2a5968444b98510f70422c
SHA512daf0d75e4de2bd1e6ba143caae4c1676ffeccc0cb64599a663dda321420321733444b2df2e2247aa288463baf4d770b89ed144d3775d83afe9dd94bbd6681b76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587e190c02d3730ca5d4f9cab51682c4a
SHA17ba6797cb7eff5d804f03559010bcc9b34b989da
SHA256262243fe6bef6059886edaee94e8fa5469d409c48660b9cd7c88363d4fd9da66
SHA512dbd28908034c6079ec5099a57867f34b8ba65d960784aa5e4dbef663c32bc0eb1e8c53309954875f53a28cd4779e622d5d6a9b40d321678c97e46dcd39739e3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b233c796680d1751970e55769f6f4a8
SHA11717459439cf04cbcb5e8173bbed4dd334c7bde0
SHA256c202024f15fd07934f839e0a91da344e8eb40774f87cc45914e3265b8dfd18ee
SHA512ee2513b69b11f0286d463a0e49109358cbf8924c4059deed94bcbfcc6ff65ee16e9e5fa3bc5cc654e5f02ae028a2d49fca2b987886b5e9053b143864b2190d05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0d6a7c0c2c4a97f7d1042417bfeb3a7
SHA18c35ff2f2d2bccb846a6de0bdbc6c3530690ed6f
SHA2568265380d3756271dc1fba515521396005078882e9efe5573b3b6099247d0f82e
SHA512b1a4a465d2549526fbdf8050f4abfa28b244e1b06988ee703af55f15b3e997950347ce4c140122674297a30cc65ce9d83cfe50d557fee1d50296512160df72d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c6a517d580ff7fb2d75f1b4ecfc015d
SHA1df4ef81894381178847c3be62c15836508bf0ad1
SHA256c39d0c45249b2c440de1fa573bb79dc7006326dd8305bd69544173360118131d
SHA5122abeead978090b8ac9b7ca6cd261a1fbc69c4aefccfa21c007c7bb0d70558ed4938e654434b8758732d87ed07c6df7d5fcd5b589d6760d1e94fdc0c56f9e94ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca97caad04616c737641b9ac2a21028a
SHA18483fc5a8a6ec8052425411b1d47a6a8345be976
SHA25634a5471876de6691407a5acf385b59d68bf0141121731f638edf4d5ded633902
SHA5128f7e0685a8a88623d20d6bc8c3f124f197cf5c5f10e7ae5f9d7853521d262f494bd888d62caf9aa51ad13907f0ad0ac4fbb6a340925b9853c41cf07b4568fff6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b3587cf51b2c2fcb4cb30d219c78f6a
SHA16f8ea5e7cf3c18b4316b557f8ae3731e98a696a4
SHA2562f7c080eec8b87fd8df327133904131b7fc91bb317e975594e212fbcaa167824
SHA5126015fa1f91a847e1ec89d42b12d6dea21a847e3159ffbc7e4e9e48af862ffb700142bbe42c3f46f112b99480c25919e7ae705878215194bd426977ab7022cfec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57773d1ea5513e605ccc338919890021d
SHA1e158832f6f61ed9d36538a155e6ca93a37e87438
SHA2569fd802e6298862d4362ac85d8e2372b2aa05ef8eaa90cd5b826a5b0f4557b60d
SHA51256162c2efd0a05807e6d395aba59dca709f28f79a84f7a1ca12a3e1593bfaf746bc9a6ab904aae19924da9e474f794577013874446cd23d939fce98c04ce077f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5354c131b9e135f8da8e8062c0a2ad07a
SHA18dcea7317fe1da431e21d8ac96c614f488505839
SHA256aea355c559269064c7911a0c1a08a606886cbb0b3c1605265ce29f23a081c55f
SHA512f34ce94f349bcbffa72aedbd051554b33fd31eeeb27554f5c439f1dd073ca3057431baf7c16fe2771aaad3a21d6be32a1cf117d66b11a7427de825f7d76fc19b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b334792afb878f5972b1e61ad254308
SHA138af3db1e82bf955a108c77e00044b939ce07d4f
SHA256f191f7b75b7af91b12613d68287f79be21bc09e84b02bd8d9079fed53f2b0207
SHA512783b0cfb5ae5bb3e1d54638ccc9a6ae6146debbe3fccbea18f247e8b3d576415de8f21b839f4efa9e8e47d3d45a5a6596f07180d607abbc6ad66e5be730f4bc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b0a47a5e9422636157f4e77d7a4fdc0
SHA1c3b8a110a68bf95dd1031779eb7b1dd1b2ab3b4b
SHA256758fa8c65cdd880fa575cd80d2950b064658fc9ae9c2e7a815c4300ed672307d
SHA512ca2b8310cb71fade2de889be44785847b26d5980783d904296e0b06f1140e531fba4ae431238b580545335416cc3fedc18541a8751e10a1795954f83c90935d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8198759cd8163dbd54c277f64d9e587
SHA1b0836ee2e6108699f0de85846b2614493b50ad00
SHA25606ff4e931f4fdf1a37d82f58a282353d1074e80b3a38a052f70d820159965333
SHA512c0c118c69e9d10eeb95c625c7d49f1e7861c18955f3b28b1e0ae24df3ddc449c2dbe4bd59e4486f79375577430eb53d895112f496d21feaf7f22f8a12f04e88b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d51a3cac40d9fa5ecb82bbf80efaf96
SHA1d4e69142c6a6cbbd819f01e719c08e89cb89a518
SHA256dc1cfcc9382e036402b14d13b96060c16ee2f9073a65204cc7621073b8faa9ae
SHA5122b5e29031805ce78204f8cacf474b037a17c0d0fea835d1d075d4df2a89cb2b4c2fc37b8e7d43f0c52c93ab256f6afbed8a8454abd203f1c7fa0669d464ce8e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a277eb27d8115d86e425c3d7bcb93da
SHA1f7ea4f49918612c0dab43123400f427c23120954
SHA2567f1a1b20c2e6e5131ed9d34d418768d8e48148b05504d9d45a4243566ea7ab64
SHA512e7e71879e13ae1c32d7a15080c1b74bcbccbee74252f7d4b7970eb35f878152f3dd3b1a3ad27beecf238595898ef33f0eb38296a69c1b85086732143f4f5237f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f12693c2bc2cd242ef5ea4289537468
SHA15f0cf336638364097bff01a4a64121b09d6be6f0
SHA256eb8e9074ce68d4de636b5285c991d03666deb2fe730e95b6c13a047f20085bba
SHA5125c6522ed70e7e71ba440203b4a53381dbe0556edcca863572ac10c6120cd4216563bf2eda2bd7c591ac961db3b321bebc0dda9256586f97a83c87447253749e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c09c6f079f4533a16a2a26e0e54e469c
SHA117573beb7176d3c9a79689221d28fc91085dcc00
SHA2567c4681725b5f0667cab3086a35a47083e011fb0b585e2d5dbd2eccf82f0c1e0d
SHA512be45db2c08587e25d611bfd1484df1e787be927fc845cd4c8c9603f626810a387bb92ab6182652a11eeb325134ff0738f5441c4a81ad26d3d001767f6132cefa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a9e08668ba6079a76be5e533f16bfd9
SHA173dde3287d437f000610750e31ccc3c15c7334bf
SHA256a9c30024b2ffa1fbcf175c7949aa1869c7a415684f80bf0b01e14382ecbb9966
SHA5129a5ab643b6f5bf75f998cbcd07f52c65b4f983ae629a9852db16fe3e4ea6e19c62f111ee1e42c042fa4a1942c9e204ba4981feb98ef494306a0730510a967cd1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a