Analysis
-
max time kernel
119s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 15:17
Static task
static1
Behavioral task
behavioral1
Sample
7d6d0625713bd30d7050a4e2f78cb270_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
7d6d0625713bd30d7050a4e2f78cb270_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
7d6d0625713bd30d7050a4e2f78cb270_JaffaCakes118.html
-
Size
88KB
-
MD5
7d6d0625713bd30d7050a4e2f78cb270
-
SHA1
b2788338d9c518ccf8f1611f333bffd9c12da66c
-
SHA256
8c027e8739448652cc782f6f474ef047bc8170e2f4c1987826481aeca1d92527
-
SHA512
efee27e70ce03f809e746f7c951e4a7214795be2123704b6ff918856814388b5f63d35cf9f7c365f3e51ea36371e5087a66fab4b8be657a02dcb5224f32ddeef
-
SSDEEP
1536:PkCLbTgepsXl83lmcSVZlwm6qq7G3MxttiWL+W6xZFDu9FMc/fShMRUWI:HLbTg61mhV583inJxZFDu9uc/fShMRbI
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ad6a6238eff9e341bbe54f96c0d7014f0000000002000000000010660000000100002000000090fb613aa10d99452e7c915e644736bd337ecdd2a14c8d2fc3100e94f35684d0000000000e8000000002000020000000e2002d66c4b1c1fd92628f0f627a8ef965030fe0a39bc71c081d29de8200251220000000835545b63405d78ef927652d259d1cd48e84e285176517a150df3141d729c2c540000000dc16c9c8f6ee8c4ac549e305ead3b719575262dde9d18a8b014dd930a49212e23554d3b6f103e812ea1962a2e7ee950370c3eb597050c1a0953cb6699310be07 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423071306" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ad6a6238eff9e341bbe54f96c0d7014f0000000002000000000010660000000100002000000026dd80569b29094f083757d70fbecc5cb1b80ea4aff4d92714478b8510fd38d1000000000e800000000200002000000069de672f4111eea675f9b4fd32eeb00259a82229921e8e1c024da115fe43f11f90000000e65cec3fa348728f91d35a67a448f82c42b6f0c553bb648130cd76cbdfd8031ba5ce6676e8574fcebd6c14bc86a1a3c806fac52aabd785498ef6143c978220cab2175ee2d891d1f97a33595f0baf24c9dc6bf056b9afaef1c82f20c9b74219974cf08bf0ed0d990339c451b17a3350a379577a23ece3fcd202de946f33d70b5d5d7c0914cbc15ab17fa16827b81011a040000000ee03bc6ccde993d2f05edd971ac03f997ee6e999dc686fc52a8c7ca1d7a72f221364334164f1da963a6085b4ec35427f15db51711755e3b27636e667d8a4eb60 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5CEE5D31-1D05-11EF-9907-E698D2733004} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80fdbd3d12b1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1624 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1624 iexplore.exe 1624 iexplore.exe 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1624 wrote to memory of 1936 1624 iexplore.exe 28 PID 1624 wrote to memory of 1936 1624 iexplore.exe 28 PID 1624 wrote to memory of 1936 1624 iexplore.exe 28 PID 1624 wrote to memory of 1936 1624 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7d6d0625713bd30d7050a4e2f78cb270_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1624 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD541e108159782ace68a15dc026b808899
SHA1e1be498c252f0d9202ac036e4b517fe2d9f7b624
SHA256f0972e001085771267f3f4ff0a7313d11689197bab4eb0be67147e758b5ab3d7
SHA512196d49e8b3977842314fa9a6b5d57506d4ee5cca522c0b6ad2730c373c058e6d38f5fa5f52efda4adcb66d8866119b40748d70a2a6eef26f7b994edee69c4feb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509b321209c6b8f8ebd0e546fa6dee1ea
SHA10946054d78b68b8719f7c1e55e345c2427a9c6f9
SHA2566190efd3039253b9cc388a6570b184ebdc502a2d82e7db5ee23a45cafe86a756
SHA51214e2a6b1d89a5abd61a5f454408f203a4331a0577eccbd57d13c6207f82c53b24cb35a3f32863e272e19e42c5748f9cfe1c75aba6392a5995749a24306361067
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b830e18ffb79e79515ffc068016abe08
SHA1982f8f6b3f93f60c33ff5b6f187625dfaac8426d
SHA256b2a005fe62d24e7939b19265ef0610ca343e834f4cc20c3e8ffcbb4fe8ec6102
SHA512c907a9acb9595ed369623e5184391530e1e16393c9f8993fda7a005db67c5d956bbfeba7e0fb6a096a6201498c2ffa9b0e562c530af785982a8f9908a66b94e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c41e93e7660fba0353a03c43d7f68a24
SHA1446acdb9c6f22f2622bf7119d98c173cc3ff0b88
SHA25610c99d3cfe73d367bfdd921e61e393006abea2689bd1a98fe03d03411359cd20
SHA5121fd341fed3142a2d91f995d9d58adcf2a852147f0c77b8c3687ef721e0af94badd3b90c664412b18cda54d3e761046b3e99a1c3241cccbde0e7cdf50e5c38c24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a427a650722f8b798b7a8b5b67b047e
SHA1e5bc00ef23d7ea69a2019ca3935f89f44eefb55a
SHA256d8896f02c7179e16e129da42f2c5b45a403740784d731f0675cd3c831dae23a1
SHA512c97281e25d9b20202233cc4276551100eefb9e31a5bcdfbee91d8841dd44e9d1fd319e6ea41e6c40ae8beda9fbf003e84299b6690641d74cfbf480cf18f8f2da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dabd391a980eaa61c5d4ae7df89606f5
SHA1e0e07ef0d45f81b15a13cecc16f325b37a6b5bd1
SHA2565586a21ec73b28a18391c3fb2df209a77166481509d1650ce36feeaa3da9a0c2
SHA512229341186c6a7d8f6648a6e47378e51fc97e05d3b197e05bf40df5b2b59cab41fc93db7c50ef2acecda607afb8e69514aba29f252208d5f1154dcb84e66dfeb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec22c90ddfd7f034219d42e6581be237
SHA170311bed2b1105474b2057226557e6a5c2f9817e
SHA2569b7889a1dc1f62fb0a0441762ee3329b2ba9955dad11cc761d68809f67a047bb
SHA51260de633a7b721290860c2cea436503cc06759eebdf162f6848c9b77d7ea8c56dd68f3b1026e04453333b03486eab154645427b33eabe628db1982181d1f751b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59da47d0f65d6444cfc0e2374cd607192
SHA147c2d58c82915def74400923c2dc7bf3c1a74389
SHA256743c8326e253ef68369db6db93b55cbf33a3bb344831f0a33cf113da4e2eb818
SHA512cc6ab69d9e91a1f73d4dfaa09ad9823ccc47364bb4d5a40074f18c3f262e7ee35bf79cd46b3ac3bc31169790f935956dd5ff2f8efcf97ffa54d6832dbea4914b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51490fe581a5bee350f274c82c951c324
SHA14f73ba0cfebd387f7059040e570a891696f716b1
SHA2565c19470eb0cbc08aac031b20bf4ccffb95cd77f2ce31ad9765078ca3f111414b
SHA512d95cbc91e1d0baff0cefd389089515c3a6b29d28b5cca5fdadf51b066a7736bbe1fad795598433721b28f8ac7f2867fa40c16750e8a0692d2eb48db89ef59d5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD55e1b99050a3e2a44abf220ab332cfd9c
SHA1923dfb2c770f1f6971be43edfe7772ca73e29859
SHA256ac71e7c12a6b8523a7676f86a4249cdfef1671dff8479f199d491f6f7ea100fe
SHA512427e20517565f3ae104073b7207cff1e737d7059192954736e01fc6b5635665d874cd3c75a90fde9bb97317879f8e2135f81dcac24bf14a84c02c24f0774ca4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD56da128720f9a5ba707ad85e012303f52
SHA1bd7b8f1caac030b9d33896cad6dabf475ba1e72f
SHA256799bab13cab037734ab53a555ba0d04438444b04dec01fbce8832ca6b8652b2d
SHA5120a00e70654081ca3fb8af4cb52071f93e89b99c0fb5ba8418ef7822c14383dc79d0a2d41e6c159a4a931aedee0d2ee12945d0093646771021100b8f52880576e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD554da4f10fa88bd0c90c18057ea48b38e
SHA1f617a20ce4802a68a209b86bc7bea3253c581ebb
SHA256656785195342af958efc7fc55a8b11339c8b0e8b845f70f41b378630157b0112
SHA51208bd932c70fa0b5655f7270db82a274aa9978503c7bcc28eb2e33f53b21027c60049fed5b37d4209a09486b1a963fe0ec4a7bb49ef76729cbc15e72a6032aa8d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a