Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 07:48
Static task
static1
Behavioral task
behavioral1
Sample
7ffe8ea0ba17d3379a8b9090971cd5ec_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7ffe8ea0ba17d3379a8b9090971cd5ec_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7ffe8ea0ba17d3379a8b9090971cd5ec_JaffaCakes118.html
-
Size
143KB
-
MD5
7ffe8ea0ba17d3379a8b9090971cd5ec
-
SHA1
d76055acf06851b3540e231a1da552bf992d8dbb
-
SHA256
08f8332d9c5d57a0815c922a0899488975c080dedb5ef9f17f7ca365a4b170f8
-
SHA512
275bf8cd1c53509f77d50c895e4658e257ac17d88099f3b39211bf0e906795b1bddcd01d1d2b5558a4b0f378148f1833efcc224899c1e6c9114537f54f3b0d80
-
SSDEEP
3072:SXfpunltx7dyfkMY+BES09JXAnyrZalI+YQ:SXfultx7osMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CCB04E51-1D8F-11EF-932B-4E2C21FEB07B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423130761" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1276 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1276 iexplore.exe 1276 iexplore.exe 2844 IEXPLORE.EXE 2844 IEXPLORE.EXE 2844 IEXPLORE.EXE 2844 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1276 wrote to memory of 2844 1276 iexplore.exe 28 PID 1276 wrote to memory of 2844 1276 iexplore.exe 28 PID 1276 wrote to memory of 2844 1276 iexplore.exe 28 PID 1276 wrote to memory of 2844 1276 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ffe8ea0ba17d3379a8b9090971cd5ec_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1276 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2844
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5a7272cfc325882509c9b71162e325633
SHA194d588ae9da3ceb61d4b49b1d34e265cf376b443
SHA25665e73a689d7349d3307b449931713a68dd535b3108e4fcd4d915c0169a6a2d24
SHA51268dd18d20202eed83de5e08d2aec2158bbec06ae4947cfff9716c98a45cfd4a787d2c5e9979d4aac23ad3a54cadc2d9a1d9947ed81f8da392a67a81d7b773cea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5432344a87402775bf63999d104a2aae3
SHA1f57f51d91458b59f52f35a2907a77e8ad190b90d
SHA25603a94b92adf321edaab7fea358a061171707ebd69ba09c4d9cf1d8b5ec1c9408
SHA512607997d0708c3c05838d0ffa019102ded3e6eb75842743df4095454b47e858b3be4c3db037f0ccbdaef4b0b41d9d1d021554fd6e78a0a823ddfb31274332134d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e982084d92e9fb3eea886d954c5410a0
SHA1fd470b51e2fccab80f06ab6c4de11c8dd6d1ccce
SHA25647aa2b1ff95e27e51311a204ae3b137faec3e00dea00d68da7287e3df714623e
SHA512db8389b2b478931be8f3b359653c22818eccc8fa84ed0549604dc42a91e1839275f19cc7708f89f8b5554a029ac2041cb6f93262a01ef82063ad812798654a91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558a8d87b840f4e34c2e023ae45b0ef10
SHA1dfec72046e493e9af12f070a791090e10800a694
SHA2568a3989f4caaa6a2e7cbe6dddae86fb988eda9d4deb8ae3018adf6a52540bbf23
SHA512473e062ddf979017a8a7428c10f7f48fe196aaa84b0be4047c1aa5b219e25cc894207f1b96dfd1973f49452554eb0cd8854635faa0adaa755fec9cec18b46fb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f2cc07fcbbeff84b06e8b6f12c6208e
SHA1a7e7a83b2a66a1b4c59b24a711e3e7184c1fbcde
SHA2567ca3abafc30209692b6b97e136b16e9e75fc1db7cbc2db38317b926338adaa04
SHA51203fc9c3183d0b8a6829ad23ef267d0bc1a91bb3348431f2fb116749c0c7e3c17e2433b9b02115c73c2b2c9fd51b18fbe6dead04ce5f694e17dd749d6cd501620
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4aaba2d715ea961da93082963cc50d2
SHA1873b470e40482d0242f5eb45a696099eed351754
SHA256cd993afcc75dd4c8ae8555b965524d7603ea462e704a8b0c79e157c6b2215a57
SHA512d511ebfbb8718311be12054f4512fb321fcfe5afab508ef00317fa485c4f16c65795d4fb2d71c0ae58b9e219738383cebe41703bdc4c256203b0b49a8a16ca4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b2c27905b04a315984e3407cf11f811
SHA11a0c472aebe030256f1f6036c963655b86bc1704
SHA256b13669f7a813a918ec61bb1e0bbc2d185620a3fd08d646934eb26b41228c04fa
SHA5121c230ddd8aaea16773083e9a252be3d16da6917a643129cb052b6a496ae05fde6071cc9aee05efa05e15274b7eeca9799f9a9d7e118e38245955be953d64fb8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5256f6ceb058c5f3404361b12e9525f04
SHA1406da2b5493467b0a04f9fbd066efc76d40af87b
SHA2561cbdacd02dc10e390e20da210886300822419664ace2d0336ff8a35b435b7bf9
SHA512dbca50733865738afb99b23fee8688f9925ae0e08298a11f0fba86b41f86c3fca09b0a7099eca871a9067c5a52b4eaf5dd2c9444da406119b892718fda09b818
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a07824be53535f2a8681dd4b52da31c
SHA1fed30e8c9e6302189487d4780f2eaff2d7479ef4
SHA2562072540c0bfa317269415081f2357e2a182654eb4a00e56d4436276b23683a4c
SHA51265ed99d6970c3f783156ebbc55f6b554faadf08578d63db1ccb69898772d6fc34a7fc4f7d5e3c30926e6e02a178fd6272939107a8830dc3e3805753dbc7ca67e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54bd3fe1140bf6c59e171324da70762b6
SHA1cc89810900b5653ff22dcb5c4d7128891fea04e4
SHA256bcf216520286895b6e1f518f4abdd092f3b6d38b7ece14fa17ea72baa2ad55db
SHA512c8524f37d3c98ace115a49696786af90131fedf58b79e9db5ad57cd868dd7da7ca6e6271345d8f11272615bc91b30585ef41ad4c791f37b0fa1577cbc8d25a6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b5ad531bd57091cd716b510f6c3eb91
SHA1716ad4362920e53c24969b6e68c22559d7c35d82
SHA25602fd4974ba52f1dba1865779388ea50687da8e338085167fdee4026a57859d28
SHA5123ced1cf144721216c629413a4e2d923367ebded6f98f4ae94229f7900ed2607f98a8401b93137df09247737e33b14864cf87eb0f9b70392974cbaf07d12c94f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d73f04edf22bd52e81b494114e662d4
SHA136d1a4587105dc803f198556f5bdc5628123c088
SHA256d94cb19060eadfc5f4a528ce439d67e44c248e4c3bce538cead44e9c63044abf
SHA512d56f076a8b78ac8eb408602ffe10594ecd72b4320595767d29424188b04079eb2c1591556efa21cbc153f6b6d51668e10d1b030ebfb03bd66e6b692151aab686
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52957cad0b41c8877eeed4f5a95f92d60
SHA1f34abb8c0a6e74e625cf3ff93fa80e65c66eeec1
SHA2565a6a80eb9d8c47b29fba86470ebf204891bccd26639d92b355c4c4af916d67d4
SHA5123e880a493a9c55c781742ff4d53a0201d354838d27580132c036d2d35cbc4c590c3e7aec1a0ff015d5c1368d2173a4f78b38cc89db8152493aa00018a690c154
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe2789b5fa17d868d32ae1fe9a0c2612
SHA1f04e6ddbc666526d94ed6d42dc22e3fd1165b9b9
SHA25624050ef71223187c393baa0538a45fcde7bf4b85959e9afbc372469fbefa02a7
SHA5125639982c2fb68f8e5df6e57a6fc04937b30904b1498b315604c64fcbe47b29a9f002b374db323be5ee6c3abff2490b81ac499368875775120a924b3a90b82816
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9636c15f01a3a0c3b459ec968d2d8f7
SHA1890bc64cc157e451d24642bc6e27e398ac813d11
SHA256d876f07198a50f8c8b482c321762518e19cae400c2984566629318c92dfb89c9
SHA512245985906113d2a736f16afe949e8ac9f4932625dbc6ce5f6905147c0fdbab76c41ec82bdc8d1f3978d6e376a7989ec7e0a038110e39f0f46a7eac9db4b7b604
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1ff7e912e2089b697a3f61186f9ea58
SHA1b3bcd4cf2025165b4b9827c23c792eaef1a604ad
SHA256da406ab81aff494ad53965e1fbd902830c4a8aec41da7fb2ea8aab952ebc4102
SHA5125eaddd4a4104bf346d27f1a10bdabd539b7af1bd8511203176b21505435811c43bb8fcfdd3f952848afb773f6ed0e0d9662b7d954d6aca5508c7f055217eed62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5137fb4ba1de5dfc42c21f006068ad65c
SHA1f129d3f02ebfbc3897e098a1765e06e793d7c753
SHA25635c07c7dc26182fbc7bf5b2f3d2b013e367c91cb11b621f3438b29c26fd2638d
SHA51221f6e085d6963d747765604115f4dd5eb8d32eed6ba622d50814a7cb570fd9e0b8a1bc96eac7f22a0cbc101c705cacc1a576c6734d90ca6bee45b8f5700c9e73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a860812da2a8dbc7895b429254f41d7
SHA10653dcb8d6c84b6f87fc613514f96e1eb42688bd
SHA25611cd66697857d476e6c81bcea7f3627a8621d4e80a19883a17fdda26bda63cce
SHA5122d6a9d176a2b6634bfb5665dfa9fd5d7032da9dd2362a0ea8a6fe0834c93bc0f4d34ed83cd3f55697538b91842e2611f06c638e7ce5e2888d42613ab108d4d2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5941241df7f2aab0207ceec182ecb6936
SHA1a54a266662b565162801275db9ad21acde13b4a3
SHA2562bec8674f269b8ae3cdb7b5aa3156f9ad9704e0734ae1981ce4f41b2396af47a
SHA51270fbe7680aacfc2bf3f77362f71dbad090cf901f10d783058210cdad02731b4b304900f757ce244efdfb831a8383c5005db0f55df573f22303f7b35d7782a000
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD59aad44635d8ca9cb8527ae0622a7cb7e
SHA1eccad80c3cf84e835b2b1300345e3237e12f2fe7
SHA256250a43f3a1a41304da683bf5f6f0ab5f3a0a3f554f65ee661c71a05d17e5e315
SHA512ae6c6f3cdba82e35eea1a822caa740f19aec33a6ae358213d09f2fd7adefc35288ada26280db877b82ffc233878f5c812686a77ad2cd71b344a6587d04c22fbf
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b