Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
29-05-2024 01:54
Static task
static1
Behavioral task
behavioral1
Sample
7f254fa320b7d285e5f733a971ca4bd0_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
7f254fa320b7d285e5f733a971ca4bd0_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7f254fa320b7d285e5f733a971ca4bd0_JaffaCakes118.html
-
Size
37KB
-
MD5
7f254fa320b7d285e5f733a971ca4bd0
-
SHA1
a1654a4c67c1310766191221893d9f731516d735
-
SHA256
610cc3b96765238c83105352dd80ca732ea7d642a25c7e8f0681ce7407df5050
-
SHA512
5e398ac48e8695795a0074d2799d43950b387c3d6117a3d3078e7bc7e5e9400184ec5c668aadb865ba0b106071c4fc34d6c529c6a6c4abee9a18816b49feca63
-
SSDEEP
768:i/bVFRFQW81D4RA+vEOjz6rdG2Gil54RZfPGnf3Gu34aMi6781DdRA4vEOjq6h8q:ARFQW81D4RA+vEOjz6raA7IabC81DdRv
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003d0f79d81b15c849b64b726877bc8c5f00000000020000000000106600000001000020000000de30652943e9de27acf6faf573246ab39184e62d5aabc5c0ea78a2a15b727433000000000e800000000200002000000022a44efa006b42a76b44722c9b9d5487f2bebc41bfc4b32dadeecfbc32efff742000000028d59d5ca87c7221032725b3ef0405c79899cbfe2257cdde8edd161327f13b3f400000007f866d2284d67f2d26d1c24378fc7f98861542a2ce5664369d9de7022deb4543d160469b2e933f132bb203f638879f0d4aff498156486fef06e3af2b7278ec3d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6493E4C1-1D5E-11EF-AF73-469E18234AA3} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ff243e6bb1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003d0f79d81b15c849b64b726877bc8c5f000000000200000000001066000000010000200000006d3fdf43c93e4c3e241d97479333c308175bc1dc25def8bece65c3c5f3aff338000000000e800000000200002000000061753cd74483fe8ac72551128e6dd430de83d7f6442312d7fe8077a67285a7d190000000ac01226198075954e9e96f814ee46cbf5dcec9705c2d19168dfbb3463358d72565fb2e1adb9d1ad7f285e2f3fe37d4de3895d71e343de3cb8e95fc8dbf26bf625df361b3e7621b1a8706c5f4c3e578a8cc5a24d01677effcf0b9f909f8108672356b13b7b3307f02834ea35d93cec8698834597aacbae57a2869162de523f6b9d5a1cadce183a507d40148b018f3af2940000000cde5d2dba3bda7a67b207b3d9c7f45b0ba2714af69879e3c131c88411bb2560146627ed6dc085486d6fdee4c0e1013e41c8fa379f11d7218f106de29d6c57175 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423109541" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2740 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2740 iexplore.exe 2740 iexplore.exe 2200 IEXPLORE.EXE 2200 IEXPLORE.EXE 2200 IEXPLORE.EXE 2200 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2740 wrote to memory of 2200 2740 iexplore.exe 28 PID 2740 wrote to memory of 2200 2740 iexplore.exe 28 PID 2740 wrote to memory of 2200 2740 iexplore.exe 28 PID 2740 wrote to memory of 2200 2740 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7f254fa320b7d285e5f733a971ca4bd0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2740 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2200
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD51deb125ccb7637480f66ee1dd40b6faa
SHA19100110bd9f266056b2df9105115125f5c913791
SHA25672a8bb0bad2ed567c3818b4afa7f096e74d4750556c51b7252e83fcee268dd0b
SHA512472413e78aac474b0c897bee7ccaef500b68b0deb9fe5ffe16bc275ca6dd379d2c517966f4233db76d7b315323bd73fe6eaf7ec5e166b2d0940fd0814a478918
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545cd035c212668534e2f70edceb2ea70
SHA121393b646454e2e2fb68c8d3a0b0b74391204cb1
SHA256bdbf7150eaefc8db4f6bf19a335d565db082e48b98e7cf76acf1158ec1b8746b
SHA512ee12d6c8a53114655a67f30e0550a9b42a833b88b394a1e3b43804ac984c20c81fa4a1a13ae8991b9c4abc83b579bf049c6f2f717f2a18243d7d8b36223159d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500a2b719d5c8e7363eff426b5beef272
SHA1a310f9ffa0729269b27e81e1363442cb77e203c6
SHA25605479f1de0dcbc39cdcbe43cfe92af80f00c152851e68faea854e1a8a0f68d7b
SHA5123b1a090d710736e1061b9b57601ab8491aadc3e209c4f7fc24bbd045809d16596dd04557d0bccaff8c51b525adf410bea2b527f52e8854e1ee9f4e447314c894
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b0dfad2cd7acb4a92a2b44b15d62ffa
SHA143befd1f557c4460a33e3451fb928ef5e16aa407
SHA2564fae983ca611a2bf563ee9c419f8bec537f956fc5e26bb37faac76dc07b1c5ca
SHA512c503ee121b64cb209295b9650f9c0ccb0a73b0f0f1a6063841281b38317491473a4b77c0cca24eb3b5ff707bd56841ed86e9c5053d77b3ed4b7d806db0d7278b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cad9a9476d23cb5f3fb6f2b4b1d32e4e
SHA1b6ae45ba1d4a135bf94eb8ce2b4c213868640bea
SHA25612d7fdd40095bcba428b39cf961cc57f6d5c8f452753c021d8adb1b259ad461f
SHA512d6e523f2a8b13d7868e085997fdf51bfe5ee58c23f08ad79e74c1ab39a1211c41723f440e546f9ee3d043f5c8cb170bba143190fbf9940704de6681ac09f12fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5998940a8d66ed5733d2e7499fd8ddfdc
SHA11cc265abf066ec4bbc6e4771328442c062d2309d
SHA25612157127a0d859eac398ec005b67b944e82263dcca4b4b2eb75626ccdcc561fc
SHA512b5795303ee7596918d8db1f0b54a09995fc83fcc6e754c992c123c62c11889c9b3a64b8b26bde951a3886a3a83edf56c3e99090c61af198aa7eb39746df6fbb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53287d68b35167951f3b40c9bfda99e4b
SHA1c7d19179e242cadecaa5d977d82f79d8d261e077
SHA256b68625db6e80af1a298ef40614d7f2a22482a3b95c0cdca0d79d2186d34b136a
SHA5129c31bec9ccffe4119c0cb5083a797b183de1a5efe4233fad1d82e518b300601f94576668ab13341717fd3df3fb2024bd3e2e93789fa1bacc87106fe4ed53c9f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b89e02328fe1c2575417bc7ce6af40a0
SHA1fb1fc91f14e22fdaa3ebf10b15136d01d5be9705
SHA2569718a051af5546ba4285ad08b1be9549214cf26160d0908a7b6a48483aeab68c
SHA5123b5a1a34fd7c76e4f6d4f1597c6d127717674fe1173edb8895a3059ae1d89ee48771c1230e033d63fd2dc07495a3b293f8fb137022b7da1a4d8af67b3fa6fdb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbe213f7df74d9d1333a5d15f58215ad
SHA1af78a4589a392fbf41de5411d643332af0369e45
SHA2565bb27f87489f8c8e3ebc6192fd715a73d20e0526488a4cd726424b1d874af8d2
SHA5121f27cbfe9e406df70aa7f715eda20168ca9a001853ffb6d7e04c147260721121e2da6fec6aa59f318638a6fa9fd4c5275a79cab8125ffe3abac166ea265f8fd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a54a105e1a26c9fefe2eee98d415309
SHA1dd64b2ef5480663e73365fc57c31860a8cdb3928
SHA2568caf71034f096e249fae49e894a8bfd22750909d1eaf8e2ee9cbc87d77d40f5a
SHA5123da9a1ddfa92c9fdbaf37e2af51f6c15570ea00193097ce4d1553a8e2ade2c483d90617d2c2beaf0491cce2eb80ea69b7125b62eca12ebc88f57cab6d68c8bcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f48b3fb2073fa31fa0fe1177077847ed
SHA19614c1a2769b4b122e36eacef02ca1ecbe776f1b
SHA256ffe44320477a66b353ad714801480a5b5f4a5120b58c41abb5b5874378588333
SHA512b50f415bf0b8feb0ed7a2f226fdb3582b088b50deb96e3688cd0a6d56572761c0012b8909802aff6328f468d0eb5b90e75e4ec95aafa7a479a1de3fd28931b2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7a9bd31ab181c9dc901af9738df4bf2
SHA1f041abf208f87be18322d6f099dbec1a5a403b7e
SHA256fa17156ba615b006bcdc3b18f9fdae6682deed3a1f6e28dbf6426aa864a307fa
SHA512332ed71f8eaee1ebccd9bc1f05c5c6c1b5f23f06ac849bd3d121837ac1715ed0036884fcc4589fe89325c397bae668d82cf3dd2681cd8755bf677dd176e50dfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD594ae737d47af3730d8b10ef25a7e5bd7
SHA1fc57c94d7b163a49ec16d8666d9f78720b9b6a46
SHA2566a430afaf2afd5ac00f46a3fd992c48a5380597ff408159dd17147fd240ba941
SHA51224ef4d92252733d516ca6e97a9d14697ebfcea8f39cd8c066258972eec046195a7cb70893b4718f3a70d150016a7e85930de0d440957310db3799567475f7ee1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD54d83a2aaf7b7063eca960a771fd0c0ba
SHA1af06020006a782c7fb8e0324638337ebc8d267a9
SHA2563be172df6951360b1d7d03bad6201cac52a0243db6551d5e75245fcbcfb7e21e
SHA512d0a780267441bd2222c48a28dcac0df82c07424c29619f071252603d9c3c5dfb59383d2684ccab4e057d55852ad7fe79c66cd0573320c64f518efaa89418e170
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b