Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 03:16
Static task
static1
Behavioral task
behavioral1
Sample
85d50bb78bef5c7e1cba236b0cb57677_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
85d50bb78bef5c7e1cba236b0cb57677_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
85d50bb78bef5c7e1cba236b0cb57677_JaffaCakes118.html
-
Size
4KB
-
MD5
85d50bb78bef5c7e1cba236b0cb57677
-
SHA1
e8438a06465e3cc0ce6407a24868f1842279651e
-
SHA256
5d35b6363c584208fbe334f0efde492858f57729bcb69469757918a336b182a7
-
SHA512
e321f328ba4adf05c0c214ef701b8bb0799805c46c494059fc4cbfca1e5b580f27d9f1867f39b9bd1d0d18354c050d3ccc8526118f887601dfc69ba666c3c3f5
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8om2FS+d:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDY
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a00282fc08b3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dcef878aa199e64e9e871b6fd9b0b937000000000200000000001066000000010000200000006518361a7e7c54a8032af4e6770a280815fdc48e06b19779368aaaacf01e9d49000000000e800000000200002000000048e53236a2553e674ea2651d9ca93967853db3671147699d7fc8fc263b2e7bc790000000b0534c7c2fe596c17ae30b133c9876bfe09030d423c7eaf67b18c1858cd3d04be0bcdfac0c619662b8e568ed2cac03535878345cfd23bef03af2af701b50221fbacaf951097750765bafe967fcbc179e479af3fefa4e49d2e692de62d9590199e6000b725d34e74364fdedd920dc5a11b03429ae385b758f54836b9821563dafa96331425e4875ba95543f1670dab20340000000c0a3edbe681ac4685b100a5c7852c4ffeca2c91556f1cc79949b0608449f976ca45efa31ad5f439b30b3730638649c44ab433ca37e8c29474c38a4756845e802 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423287249" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dcef878aa199e64e9e871b6fd9b0b93700000000020000000000106600000001000020000000cff3bc88e72f8d834d202b39dff286171c82a4f4043279ecab12a6d61fe28996000000000e8000000002000020000000db6bccb4a5acb50b29d9fa9e7737ca188005dc7c0d46ef1a38bd91533746eeb6200000005d1815210075a9138fe39a5f0916d73b5f10e4fc24751a59ad65589bc1514ad040000000ed2debc7cb8ada7018228241af8d38eda6a3569148ef26f4c1df7b76100f7f656dda858b96b75035dbbbfb498727da0ff8019c5aa534bb082af4baa187f8fe0b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{27FAF221-1EFC-11EF-A3F8-62949D229D16} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1992 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1992 iexplore.exe 1992 iexplore.exe 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2116 1992 iexplore.exe 28 PID 1992 wrote to memory of 2116 1992 iexplore.exe 28 PID 1992 wrote to memory of 2116 1992 iexplore.exe 28 PID 1992 wrote to memory of 2116 1992 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\85d50bb78bef5c7e1cba236b0cb57677_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2116
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507e1e1bb07fae0334d98e4cc0432a384
SHA1fe86e7be99cd790b0adaf71e219704705c5cad21
SHA2560ba138b13044be393fe4c9b4cdfd7c4b82e8c35e0fefece65370d4a6af7ead07
SHA5120e4bc26edb135bc89473b02c06ef2f44d019004b2f49d2c6ae72c231f88c784be97a891ce124b2ef5d9bdb4366dc03cde2f8c67e4d128957cf15bfe7c56ce938
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5872ab6167835d66f588988e28c972a61
SHA10b5faecd7cb263fed2b0937e5a0d08ced8cc3414
SHA2560841a4ce36669f2804e92a39f81ac19fdce2fadc63dd03e21a129ce882ac7582
SHA51287c6c5396d3aee50d201845fd64c8fff02773ce0c7037489ba2452353574606d075888677144d647ab95a110ac7d68b6d87bd3c25b0de5f25c8fb5b5fbcdac73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab17be3df42651f19cdb4e22197c2314
SHA1e84dfaae9935109be19f032a7cedb61c840812e1
SHA256a908e4558ce9c4cc9ca740270c35b506106522c9bdc354cd1f43266f931801b2
SHA512a4a7b5682ffa9f4027aa00c05a923b5cd28c6c8b2e2ee2acf7ddd54b014eb5633494a7c57248fedca5d2cfe9edd03fbd5ce44082db9839eaa78b2c12e927bead
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf3b05fa332fea1189fc8bf8aab4f825
SHA16dfd212a6094b7b6f82ee93ddeee2a5205f31477
SHA2564099744d6eb178c3648ad0bbfdc8fdc6c9dd97259228e2540e02338b1efa339f
SHA512c597ba8ef6f97e149851a8f3e6ec85eacb0dba56646ad30f9a0c416ee96e51789c8a3db34b715170f1f24048d720dee808a16b75629f80088b430c5538056f39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae518a624f64adb62698a9fb0ec1af5e
SHA173542a43b4824f3834966bc34d551f2e47b6518b
SHA256a8d0c38d738fca64ebf05a6097323a0cb9f2520982996766c0ced2afd7ce8e5e
SHA512f5a8e280bd1981d887bb786340afc033c332d9cea28137270e3a61c81884856b8ecfff3c22f3e050ab469369e5efe137fe3c447876febb8fc31c3ba9af11937d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b11a38c1b782cb7ea51f4b716c0ac438
SHA1f76ee5dd9c43cece5882dc19b7a207805eeeb8b2
SHA256cf2562e492294897bb1ed4fadcce5eb0b49d0f1f38462b58fc24f33243568f7a
SHA512a12c7b66eb03ee746310be4289b0b118d09e275fa84ea4558249d66d6696db491503a4cf4510cd4c3871cf84f5afbe04353c4b5f4f1d41b2635f7a634fefbad6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1746b6171f5d9d8c9fc7abcb8680006
SHA153adfa6ad2cfd2a8c36c36572ca68aa452a0badb
SHA2561db3e012804129d81388821cd52b7d389fe4219072bc16029d03d884304cf02f
SHA51218c03df9bc304c9a3a5c52274df2c13f2265e0d513bdc724e8726f1d87fa4b48cea82c909e20b7f69fb3d73344aa99420b4618783e1eeaf459e49c7488dd4bfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572ebbad2525de7ac93a42b4bd8295201
SHA1c5fb3e2fc25a7c6883feb6f55731d4d21dc2ec06
SHA2561ac243c416bda287e39f93e34f6ae53daa2d268dc82d32f0eff247417a271da0
SHA51280102938f768da40f8807700150722efeb0b78f779733600e166f7766d26aa28f8fcfe6c461331827ee921ed321825bc9653175032cddfda27fd5b033502e02d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b500f538c01d08d56b7057808df44b49
SHA1453356a33c0a2606393e082004a32497f36b5de2
SHA2565fc3b7e37b26d3f979d3b248da40cdbdca6b125a38675f4e4538b6cf618672e8
SHA512bf8dad3e2966d38de4ba7ba1d55bca2cf2bc5d7f8e16673b5e4aa31b52617411da104eaf3ee6d3736509e441b62d2411f86bea7f584606eb5aef4d2639c82ed4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b995fca258268e31e64453683e52f8e
SHA1608c4a8a5a31d0e749ace114cee9a9bffe59075c
SHA25617ecbb06aab887ab03566d1a0322daac900fb0a809501cb7883831563e2e94e6
SHA512aa8808e2e85f3f8d655f11821c8cd2f87bb7e8e177f2148e6a2871aa8dcb8736fa723e510e8ff877f2cfb2990d930440c432c3928dbd3a40a9f82a7b9591a25c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512b741f2a000e74f10646f7ccedff562
SHA1b88708a0822d2d832ffaf0e0918cb0dca2332f37
SHA256258551f6e23610e5fd9acecd48a0668c4c140692a274ac75c1c95805aeea07a6
SHA51223abdb6dc6e8a3bc248ddba814ae6803893c7f81a69fca826c7dcbdd1b73c05bb251f432ad05d7f2d98f2a1df52b514af312e9bef145c2b2e671d5cb0f43bdff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575ed36837150cc132e0b3b06d9b35968
SHA1dd80693428956e7cec8b1670b486fd5bd55ffeda
SHA256ae0d304b5d4a7dfeb6da3988d09ba1630de5db3dd717421377b2353ff88ee6f8
SHA5123a4c42dde9fc7ce14777224163e2c9c8d8c6d832dce05f24a6f43a71798337938ad0be132b3e3c8b3fe6d30fc5a91e8b8f85f320e7ba3a6bf34084f022a92e9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c84e30b9cd85f9efde4659863664f2b
SHA1e1e0209283f3f18d7945a2c0475094263aa2fb5a
SHA2563fc20ef8496bd7d47a56df71c655e77709cf4271e473745d722fe4b35ed618af
SHA5125829b38f6764f865af3174f7db676ab4e3414da8d5342b1cd996f5e7a992b74bacb8af5e03ef1f63fd5d535ef0342edf7e8b29137687e5f363d9f98fecb2c553
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5026902867a40f0dfff27867ceb21ffc9
SHA12f43a748934e40d1467eccb13390138a8373808f
SHA256e686b1017542d75f5b7dd89ee5b91baf14ab7149c8c3d75d39eb37b8e9756450
SHA51246237401fe82a6330e00a7b20ef7fa760d76233d624e316c1a96fc3fb4ec3966a0787a7631eeb8a22d9a3a5dfab319357ba1c0d112df0d8a2e53750f6b29c664
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56031f3d31f4ef6304b5ade3c5eb1de0f
SHA137c8c6699abfd06ed4048cfa7c12541d8c54e57b
SHA2561ce5d7e8b555c1dc6bcff3e026442093b9e118666f063a7d5ef225ac2a14759a
SHA512ef0ae2f611ad1a62327762ab8bbe17161b50733a8c375fdbcb7e1df6064d78f5589471d61705f051c60b62a31410ba2d2e2bdd1412f38cba62b67d1a31339e33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd4f4ca4a823a81c76ad30862155b743
SHA1e17995e7a34d7d32c69eb1fe0a410533e88b1f45
SHA256fd06eb1caa8fcde8243ee72d1ac56cdabbefefefc1a839b2368624fc9ae379b4
SHA5123d78199f9fb31cfda135c7c9ab08f789f22a02a72b868159fd88983db352ffd554a3caf7f8f0492369f5de7adc84f950ca51caf00b9c5a21377fed98512d57be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a754f4052a6f932ac857964812a83d57
SHA11dc1fe3624e1295a167b00e6760171834812e30d
SHA256b490ffc83d987a22dfcc8bbead0aa7397e7278b340262ff2782d0a7ae60782e5
SHA51298b9812a1a391f69e31977e97b9bb990fa303d65095da5319ffe80eab5adb368e135cbac02f59581ea3b8d95ce582cd154357b0d939d87ee257f2766f29b94cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7e06e7049a8cdd33fa4cf06487e8e21
SHA114875ede73da35266f0c408023e7cc48cdfcf0a8
SHA256108fb1066750aecd7b30a0a44dd9e6efa6abbc7abcded0c4fdf8095e5ab31f8d
SHA512c6aa7013c35da3d28da24b383e442505ecd68293ae97ecc06559e8ad2c7042dfdacb3af797cfd8d0f04584d3c11d09d0d9cb57186677816e84b2e10285cd68cc
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b