Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 09:29
Static task
static1
Behavioral task
behavioral1
Sample
8044583876bff528194e3b9272f21391_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
8044583876bff528194e3b9272f21391_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8044583876bff528194e3b9272f21391_JaffaCakes118.html
-
Size
66KB
-
MD5
8044583876bff528194e3b9272f21391
-
SHA1
1f59ec2b165a44f53ec81351253ca2139579b986
-
SHA256
4d47ed1be82b48c5ce7b10c4ed3ad9e1d6783b049e3bfb20910c5a4b68fda5f9
-
SHA512
39e7f0682707c32766dd3ace0c2eea62f34d4ac2273cc2fb431d540f07a1f66162a3e7316d8fc265be6956f34fdcdb859d338b1f7bf860ccbb747dca14af158c
-
SSDEEP
768:JiIgcM0St8tN99OIsex4GhIoTyOqhCZkoTnMdtbBnfBgN8/oycc8QFVG8sP/IjkE:Je+iOFTIgec0tbrgaCcFNnzAC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423136850" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003196d35722deae4b8efadd3ef2953b8f00000000020000000000106600000001000020000000b74965f2de0d4dd2d8628fadc4b4b3ef572233d1de6e6ce6dcd2a5f6fd62d034000000000e800000000200002000000032d9eabd6a7340188bc9918bc815f92a5f2262c6b8e589d0a13ebf9b012947b42000000053969d1cf27b23f57dce03585083227704237a95fe308266c2b06fb03d655ae840000000ece48d6c778bfdfed344703ab66db86c138be7672df24e0f24176232ae7388090e8041fb1e9f699753cba8e78bcff61b460d9f360d602b84b0c7b781cfb53450 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0cc4dcfaab1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003196d35722deae4b8efadd3ef2953b8f000000000200000000001066000000010000200000003501549ad3b45fbfdcf99a16985bbc231c12a492315b4fe194f1028c66124096000000000e80000000020000200000005e5a7ebdb1cf8a4452cc52742e3d5b6c691d2bb9a28ffa6801796bfc2e1166be90000000c9ead65dad1d0c122e14a9fb72681fdd9bfda659d357619a44d0a295f26a5a154f4a593920c6508fea5d8880e20ba8bfcc9e1888cce5b09841b61f659c90ee9d9973a33460c75480e6eae3499e3488b90ecad992fc2f3cdb033fe862de9ded272403a91858fe4fda80dfaea711877785cb893b27cfa627632e8044ac2f31af1a535dacc52e3c9e2d3f421dbb9b27d09b400000003fc8a9c9c932b469f21cc17084ea2ba05149095a4622b3a727d86b9853649e86aa78f07fca349138363b23fdb9c984b565129b3f45f90b336b73f364cd13bcab iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA9897B1-1D9D-11EF-8B6F-CA05972DBE1D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1728 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1728 iexplore.exe 1728 iexplore.exe 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2712 1728 iexplore.exe 28 PID 1728 wrote to memory of 2712 1728 iexplore.exe 28 PID 1728 wrote to memory of 2712 1728 iexplore.exe 28 PID 1728 wrote to memory of 2712 1728 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8044583876bff528194e3b9272f21391_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5caa3b6163e03677a1b34f6684425d677
SHA17bab24be53a845b724a49e4c37b8d3bf1e514cac
SHA25659ab98264aa317bee453c1b7c4bf902cc04a2a1d3280f9afd04a4060cb484839
SHA51225345033342a695838406f294f7efe8788b033fc1210892ae1fea745e6a942775836e68df515a835b4efc7382dc3c80ca7ddd3a3198fc765ae4da995225115c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57aaa6bee56641cc57d14a059330a74a7
SHA1ca00b52f98b46cae7fbf523a127b31a9e4d673b7
SHA2562a63f7588196977c3fdc511b1404c295f77cb3c17c094ec7db2b3f89fada6747
SHA51204192d478b2cb37b97ad116d1e96ce74b9d603868f2680197d4444fa61a656bf267a3e2320cf5d64402972c980768c185e2f75f328f244fce235bbe67d49cd74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd855f379b4b455af26ee6e171496084
SHA1b48b23c7c088c4b6428a69c8e356424579d42983
SHA256fb30926b402c7bde7ca9c0b060723dccab1c4dcb7670f8103fcb2b4dcd1598c5
SHA51235b023727052dc93c34f3b5b20106fc9c803e76184ba9baed6985ee8b7060801e1ce23cbc5f2e58d3707cda98c003f2002b78e513e9d6af9eb4cff4bbcfd629b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502093edba24c0a42a6fe09d3f1bb6d6b
SHA1f3b7cb466f7faae2c6d813dceabbb317abcc5ec9
SHA25617c1512530c7600e678ed5db4510c2c263845e26f6b57d6fa1dc9a08626be9e4
SHA512999416395815a9f21fcd26be70e1302b3e98b6fde8066004543c1e8aad17ee14a68ee41409f87f4edeb3346c85166228ebc1bf3426e5ab5c8f757650c60dade7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c97ccdaa2f17837c8843357ff21845b4
SHA1054819b4fc23b5068bffbb916670698eb318518e
SHA2563bbedf498cbd64807f0b92469ee95daf75b1ed4c23f9b3e56fb10921f5c0ba18
SHA512a40e6cddb9137f37eb580de8721131ec1a1e8a3345991fa34ea7e6c0ddf715b9796bdbae0e965993b02c8063b20cabfd3e6eaf2448a2c9e4ffa4c3757b7bf54a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6aad40eef670d857c74fd1e755ad90f
SHA1eb94f37481e8da9af415031a4d267d558e33ee73
SHA25675116941c3e65b89a8c622e0e55a29fbb76987934c098044822afd9090a2a304
SHA512aeaf71711c4f37b4d93b6c81a8cdbf21e164453e1a58972d995bfe3e525850f3dec83c0a9223ef3fa14f7799a386ebdae6e8c55a0604ebb000a9dfdeff70812c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59be566ba5f7afd415f4ac8a56ef967e9
SHA1d664f71511ff152eae509d97aa63eb451ba8eb4a
SHA256869fcc002e8ca87b7aaaf198ad65098f54aeca88c1a520de36147b9c10844ffb
SHA5126a1779d1583450a0994d46fb80af31685e99addbee153f3a14b7d358f36ff8ee1f93e1bf3c57cf1bb37e096ce9504a150405914f76b0fbba226da7289a706f6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54363f639ea6c3754d643ac5a2f22c667
SHA1476de01ed25e6c4690e8bebdde57588cdcd92f34
SHA256efe06f4cdcda209dbcd46f56e977522d92aba38733e97c1af9ba9db19cf2cd02
SHA51280d7c3f4fb87a9378e1f429915cbcb95c0688fc838fe25d97829db0dbc64b705731f06e3af64dcdfbe2d57d8e41cd8209489da802b011ec3266425248e3d208d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ce7e16a5910e54cea0f6678f49109d4
SHA12739a60d0dcab0a130fa14c6faa53cba5583a5f6
SHA256c1abddacb6f792bc199c45b92ed344acf06beb149afc964ae2b39da5c8cddc9a
SHA5124c0f7bf1734b8c6659cff9dad7ae3fce6ec50c30b0eaa892439f614337b8c7c83c1358ed402e3c08abb567f1a2d51b0bc866c954c6027f0fdf4480444abcac16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b81d85dbaa9ddaee339eeda7d801a5d8
SHA126a10179540cb274575f844581c7279ab6b97527
SHA256bb9a5e6fa5cd004a501175493a96f8793dc2a0c7040a3a379de0a6b658c2949d
SHA512abc524c88dba1f2a8865cf562b7c6dfb9ddcbf05152d09ee0944574c9bb94da08d1c7a11e0ea9b45392f16d2f53a9839970e3238eca57f86429dfd7bd1fd39cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a810b2bc82a71827fd17b7480f7b49c9
SHA1cc1a63c198f07844bcf0e134d096d437db0353e2
SHA25664c8bbd24029007a25f45795a2e4773a0c2266dbb25e11821f2b815e38815312
SHA512a0ad8c64ddf6a95e8f251d71b76b36875577a0e4a19c5439350311e113a5da5f9fcbfa296459535986868b3dcfe2a15b7bf0fde609af6643097ccb627e1c8e4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd170118f36b07eb4634fdc822b26f24
SHA1b644f17acd835fc79f16a29fff76792367321c2d
SHA2567b1f6b45ef453c093e2e4c08be4dc9efb7792f90dbce470a294197f939b1a03d
SHA512d26f1eac31fba99441f311e4808d6afa92412ddf03cb11bd7f73cc5e086bd41064a747b3cbc17774bd9784d647ba18cba0a8453cecb967ee44ee9f910f23b3ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52706955865239576343de6761563f1d8
SHA12f8cd4ff4de5beb5bc50479a5302d93e16ff32da
SHA256e4584f41b80d39018aef4fdc68ad4176b76c534b7e10a018f45ff2fe1edd9d68
SHA512ac21d0dc98c3f1619fa314c684dce088deaaa37b08edad6c57bccddf2259f35b8db7f92ee759226f2a43aa172b67c5b9a8a34a26406a671567aa174159c6a9b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579717f776cc3556854e07da47494bba3
SHA13f3d5ab44df6a992ccd32138c8a1b9c3821e6d91
SHA2565138efdd578abb0b362ac4199a2214b8cd40d9140ffd25a060ab1a1787121069
SHA5125d74739b042e28ab12dfe10e31ccd3233a937f55a3047c4e5a15079c9362415d888807cc92b8af3879a3c7ef9f11b73ff4012a13cca9dff4159ca4a4d14a4239
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f083c169a9ff85cc9bef1321a8b15533
SHA1e0f6a43a7942f390ae683fa75b0d8fc91245fff6
SHA25645659ad03e3262cffc9b1550ea378cde6bd0600bf02dcd2a97a0c2d90ab125b0
SHA5125533d8b892be883760ad84ad6372d7c37adf18026e33563b42640f2ce2c33a32698629737391f68904582aab4bd65f6f99f24ce8a08147b1207adf820b6e298a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59662f08d08bc07ca697743a83052eff6
SHA12c6f439eb53b2a7ff70eec28831c1b1928626f37
SHA2567480ebcfef4d6d3492eb50d053dc3ffd3957c08e25d2d0dcfc9af918e5f4514f
SHA5125079b4228971cff7783fda70683ae14d83a73803f5a90b2c537ae1c5cb1acaae44fbac6750e44af8cfac4b5632b3324da02c887be91627d507851a8e95d259d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5352b2b1c9dcda90ddf3973c5bcbccc80
SHA1fbba2f47e7693a9d5eb234ddad17902ec28094fb
SHA256dc953c12b919e59d44cd52e320b3d688ea27c8c09e5178d30cb5f8ce216ad5d6
SHA512ff1465a38bc437f248077894a8afaf6deabc8e4998c13a2f9a749632530888810e6eec942f454fa3282955539aa50855d99db475d34876484c87b3b7b2391f43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55905b84d80caa0176060c32e6e3a2a7f
SHA16d42193291a68805e4b57171e9153e11e7b921a6
SHA256e91d4161b1f46b5b748714893c7505ae87a3c1c77764a3796bb540acb62957dc
SHA512a80f377ce94600d1255cfe4eda891226ded5bf4bc691e49bc20ba43219924c37b6a45c22ac0a5c8744f053a8f55acf1bfba7842cfc4b6a1cc78ea528cdeb9671
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b