Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 02:31
Static task
static1
Behavioral task
behavioral1
Sample
82c5204b2f923ecd8536d81d367ad7ae_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
82c5204b2f923ecd8536d81d367ad7ae_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
82c5204b2f923ecd8536d81d367ad7ae_JaffaCakes118.html
-
Size
27KB
-
MD5
82c5204b2f923ecd8536d81d367ad7ae
-
SHA1
42c3073f0726018276828a88a8de9ec95d5ff272
-
SHA256
607068550725ed75d527af66c5ecdebb3ff2bd586cf3b246d61a84e4a68207be
-
SHA512
9af754c45730db248bad01b5581555068cb3f93b274bda7221df38ac0910077448fcb69c78c23715ec1549689a7126a9af97760cc92112800826d21358556817
-
SSDEEP
192:5QPHPFl7vFZ7vLwxlZ9TsVi7NaNeReVfDrjWfJQhyTWfsbbHpxWfYgE7P/WfSJ/3:5QvPTfQ9l1e1rJyl7pt1/h43bn3FM
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423198155" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000092d149341f5aec45810caf97515e4e4900000000020000000000106600000001000020000000ac225df83dc1e18873533f8fccb1575c36abb278d94ca3a2a96e400507ababc7000000000e80000000020000200000007b75416e6ccb8ef9f7dcc210d7ea8639f498a8435010baf86648741ed9f672ce200000000483f9506a0ebf63cefb85e1e9b0a26033eb76c0e24647d2ddd3dae1fba3c85040000000b0b8d7d83e2ddda9e5b229c03bb6c3fcd4f326e0b51f13967ac07deae25acea9948b32e8500def97bc4bbfb4bc78c8d6e04db3e612208a8756e39aa80fd7b6bc iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000092d149341f5aec45810caf97515e4e490000000002000000000010660000000100002000000066631112fb4227e04b599296976b7704280b3dcb19da32a2266040bfad5f3f2e000000000e800000000200002000000014ecc19e62a78671875def008bfb281213861439ad406a4355182643f06c5ea6900000003524010594b8b3814d0012792fcc9ac180a4a6c5e1697cb14ba05a11dcfb8a84535089aae145c5ee4fa1fdb0a1380bdfd82dcf49e11980e16a7bf6867024a2870a489687978019ce22e96e1322a157844161488fe52f8574b9212cbc0918f76f80c9b8cd5cce51a23daec3a6d6caf9e61ee312326cda09b68ebcaa872cbc74c72e4eef3bc4a241648299e8cfd717febe4000000030e12bb23e4033e4d5196b47dfbb05094052812d07564e5c75897aef5b97d1f55e8cbd26cd00933406201c66bab3aa4d12a367eca3ba5494cfccbe18591046e9 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B74119D1-1E2C-11EF-B937-729E5AF85804} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3094d38b39b2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2308 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2308 iexplore.exe 2308 iexplore.exe 2076 IEXPLORE.EXE 2076 IEXPLORE.EXE 2076 IEXPLORE.EXE 2076 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2308 wrote to memory of 2076 2308 iexplore.exe 28 PID 2308 wrote to memory of 2076 2308 iexplore.exe 28 PID 2308 wrote to memory of 2076 2308 iexplore.exe 28 PID 2308 wrote to memory of 2076 2308 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\82c5204b2f923ecd8536d81d367ad7ae_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2076
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6827e136b1bd246267664a6666bcae7
SHA1432315c398a777ffc84e5de39475c3be5ed4a72e
SHA2567dff8caacf382261db55e610bfeeaca9e89563a0f304559f610af62713ad40de
SHA5124e155e4c86523d2625ce6c5e1c750b0a4c15bf106c04727c42bf461eefdcbe8985f0f5be3e38648cdb6b4549021211a3c2c1f045988db2489ef55687f586e088
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd6baa0252b2b7ef1c89f5c3d70553b4
SHA1238f062b29bb884d47e581c2144a989f6d94b549
SHA2560beb3980fa64e839affc058b26c6d77a475c7f5f345329f26e6264e4c858c7a7
SHA5122b1cce4513b0b8dbbf90cf63c0c6a523d31d422a1eade59d48d0c4d393116031c961b68a84bb786405bc139c30c46c61ec8d8689a2de5770d4d8f0967202f412
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583352dd0615d85eb4d662d0879427257
SHA1952a681aacc1a9858eeb71c1108cc6d660b8f575
SHA2569484cc24521d60af4491b93e72c797b24deee25fae7c68811c59145fd001f938
SHA51232f17518126d968608101749b1bb306399eb12040ec7ef0915f8c97beb6e398cf9c8f1bbbf007422c89f26679700511229764ff9f3533e11dcf43ba13c1a2399
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5718201d14d717303ebfb88f6262e90ee
SHA149a4efdc7756021d058eac6339872b079c7dec26
SHA256160a531e273949821083ffb4fd2f85eec499026719bc94306bf24b678d5ecdf0
SHA5122a4c408d972ef32d438cb592f39bead230a76b6bf73a60396c9134ce841dc49123416e6ebda6d21ceecb8a7f50dbd51ea2c1992b11f94aece8fa193c073bd0a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571bbe90524ccf6b12b0c560adb25eb88
SHA1fe12152c3f26d0af4147d0a745765830c03745e5
SHA256a207f0d56b66dc2edc86f9415eb7036c3287fdbc24d90b55d6d9ec5a3ab236eb
SHA51235fd6dd173c8439a6df0d9fe4dac06cffbe528ffdfbb73389613f48b5c4fccb21adf1c988cf3688e1b75050d458f00d39022442e794c9f755cca65088263b76f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59177c87735e1f21648ce9bef9b50a4ab
SHA1bafb6f2801956b10953bc4ab88bcd0d85c5c73d8
SHA25654f76181a7f9d5a9200b143b05bb9d3ab8563bf97c221030aaa23fb33436e2f8
SHA5122b51a47c2e458d01c6089f49b312f7d75ffb2e82581c55b86db3a235bceba84b6758c4ab5501cd6fec8fc95ae82afbc6af4c8a454e1d3a7cfbb0294c6d693637
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56012b5fb8095060eaa62548b6dac67c6
SHA1b1be8db0c69538e2ac0157d5ae4364f68e64cbe4
SHA2569d1f9b70152c1eaf3ec75337882705a8e35c01986546f125f4d1c84d45c6630f
SHA512e800dfaf92a471f97a9c6586056d1ac1ffa2d4874a0dedf69715fdf4670fc674cc6974a0acea732f8c56daeeec1191ad9cfe04dc85218443fca0f9d7917ff7d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ea0c1c106b82fa04ab253b0f2064c5b
SHA169edd20883500479d1b299485601e041862b4d82
SHA25629e52591660155f39f192e05b796e2cff31c1fba0f390b1b50bbb7e61d591c85
SHA512ef3e06f2c16a1917795e5f250d1f09b1f38009735fabed01b6cfe0b7f52907d36709d01c09133df38754f27cdc9ae2cf3e23374018e103fe6545fc425acdc6fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59abdaf11b6f28fb6f46300c12fed72fa
SHA1f8e71a236053506a7673a32017e771cf88f361fc
SHA2566fe1653039d6950b3aabd872cee3ccfb41a7c95fd5ce13b1bd80db0ef2386f9f
SHA5127dd7ecbdd52b7b6a417e17841fe5e685bd88323c0596a709e9f1cfe60c52011b01edf6c02b5d9653c61cf7d8badac2232091225c5481d9394d877895caa37074
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547866adb7f3654dd5a7c986919d02323
SHA1eecf47bfbb3fc20b650154665a42b31850e5cae7
SHA256e23179355c9428f0a46e8f207ccdf9acefd6755473a79ae64a6994c69a21f57d
SHA512a0df3daa4bd3afc402219e72ed95b1ec1e5edda8d145e59596c320f058446700c0f098ed7bc8c53d136a12ede2271917cdf5f2b8be16f51c148c00a55781a5c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5159fb7a6a15a359e2cf88348044d498d
SHA18dab1b9d5622a9c1ab62b1da04da7ac4ae6c9201
SHA256e7204600e1510b874d9675a9e1ad7c0415adb889ab4c8156c923cb6a6b5158ee
SHA512893e2c618c239d03c0ad659ccd35f7de2a6eaf0ddf3a468f7bacb53d6393a09ab989dcf805c6872aaaaf3e2c043dd7de9c7e4c94ddde01e3a875daa46c37612e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5517da2e73a0dc78a1aa9209692440aa4
SHA110e89a08f34d22f35e6b350546e35da95dbee2d5
SHA256846a5a95120dad58d840ad93e189018a5a681218e5225ea1b9da6f385c687600
SHA51251f57161d570c682b174ddc52d2e47cdbfc7b55b53f27b76a40821e43d3dd17eb00e9d250d48fcf4a7943ee4c89591bbe6ce2bef226fe0a59ef0568f27dd9dd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3092faca44052992f3a74d086ed7e3b
SHA1b5dcd39ca7878c664a25b9fd106ebc72dbb0ec95
SHA256988885a78226933eddec11fbacef62db47dd7ee24d1a13ab3d1fb1920d7542a0
SHA512eb098015f3383a8a7381cc742da1e33a41d8026f2b1d366a13c6fb26ce50520f3b9a6117091f435b08024d88c19a6d1689cdd9694e1348e89cecabce1aff9fcd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ace6b7989013159ec951e7789f068ad9
SHA180f089aa1288d70aa702b3a345783bc328bb8948
SHA256db09b298e5fd5ca87714b9c00a02aaaadcf181a50de76949a808adc019728218
SHA5124e30ff66382c2e5a8374e6ed5ca01db4396e76cf993a4ffd835c0dfae9687520b20994efcff3360e31eaf2216cf0cb10eb2829a6fe56809a68919bdc708096ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1308cafefae536517d1e294652a6a1b
SHA17a10e197ac983d96d9c32cc7a928fd8409a4ee33
SHA256fcf9dff17e1db51953c65d35bb006fbe303966d03d0e104eb7f4c1ffd529d97f
SHA512551706f9b2e8365adebc788080a9b33aef0d5c04a039c92d42c185ea44c8fb68efc1a8f6288178e7378f1e6dde4aa4188ba3b8f359af263c1da23c754afc41cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564d930bd95f5342d9c452c86981ab4dd
SHA172b20d20ee19e49f7de0c9db13b5cba97b3bf0d8
SHA2565a72c0be85e33ead87726ddfc7eae2960526b731d9173f5781b2802b98677a04
SHA51263aa1b7748795d662f29a89623a1ed0c3c50196d630ab134e8af065e2d97d1dd3dead1008f9ebc054c124147e49f50372423c8a4439ee16ec501dad6714a1d37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541f39323cbdd5b6f281a886bc155d9c7
SHA1733b000b73054f3e073b351eee4c35745e76570e
SHA256005daecd5b25ea6c09e16d1116639d2fe0f81df7bd380aeb688de37a64ff1970
SHA5126cda9beb4f293cad5cc3f442737141dc92e9ef414947bdef255424b2894009618487d680720e69ca5b058219f4b4774ea2b92ad029b6bada7e8d808ab6e20902
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592ac36b91c0553b574a5a69eaa2c5488
SHA15be7c1f4a0eae5a18319e054ebe23837e6cbc750
SHA256c2fe44d71d03567e1410afa4ed32d14b9c6cfbe3d7ce1ff63d72486bc39f77da
SHA51278220ee48cb137864085a7768573c2beb74374ddd9b026faa940bd9d4a5b6a2d00446188b7dcfe7cacdf1a43881b097f03db66981244a078edda6aa58e2ca503
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b