Analysis
-
max time kernel
136s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 19:19
Static task
static1
Behavioral task
behavioral1
Sample
8810bda43f7c6d90d35b72d6863119c7_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
8810bda43f7c6d90d35b72d6863119c7_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8810bda43f7c6d90d35b72d6863119c7_JaffaCakes118.html
-
Size
452KB
-
MD5
8810bda43f7c6d90d35b72d6863119c7
-
SHA1
1cd2a7ceed6237e23580d269bf44c3b41abd2558
-
SHA256
f22424cd73fd19e861dd58ead06ceff9a17839c2b855cd3cb4e207bc57e53ade
-
SHA512
8dcb2b013ef4c1bf27bdad5fc3b70f938ba2e7a511caad63faf6721bfbf706ff78814405508405d20fccb6465a39b72687d0d1a8ce60579e1a506952ef4f5441
-
SSDEEP
6144:SasMYod+X3oI+YMsMYod+X3oI+YRsMYod+X3oI+Y3sMYod+X3oI+YQ:j5d+X3o5d+X3r5d+X3N5d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000098db542de2170588fa2b03762270974f522ddd27ab469b7f0c726c9b733280a5000000000e8000000002000020000000f903b8e00d46c947f71afde10fbd97e418087187c9b3b3512e71fa4ba43d058920000000a23460c14ad6d63c5bfdcdf075d771469437f922d0357988fd4622818f0414a3400000008d47a863b7c601d513ba12792301e560b1a3e2efe9f0e661c7635d69da214620c9140f899a1cc7088c011f3c3f969d4e3cd26dbd1894aa8f35ddc42e8bff7389 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423345013" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e5bfb88fb3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000082c22f4120d78a434e256b8b0d3bfbb7213ca6f7ce551b99df390c70a5949c94000000000e80000000020000200000007d2e37f6019cad97d4236b034edc79bd3c822faaba7ae8d82096b258439ae238900000007a3bc6f4ee0733301d01e62d2f56c5feabf97ec56f697a6952d16af040e87c6e71c815a7e97575e9e8463680f2df73850dfe645e1c5d324b8673a1d84ee4be8e014a2264c45cb08afd8ef5c632be86e38c32a14319fcf49bdf2b073a1902387ca3158dc578dfd648cbfa44a7697a0557c23f83bd9c808e8428e69eb659c32e7a87b3087ef1cc3d41ea9fc417cbffa90d4000000099fbabfe7594f513d872d8fecf34719f7f924691ff3f681895af7505d94ed929a27f8c4d01539c615ccd346e71fcc9c6007c3e2d8e01965855b3367e5fab4cb9 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A56C4341-1F82-11EF-88AC-F2AB90EC9A26} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2264 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2264 iexplore.exe 2264 iexplore.exe 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2556 2264 iexplore.exe 28 PID 2264 wrote to memory of 2556 2264 iexplore.exe 28 PID 2264 wrote to memory of 2556 2264 iexplore.exe 28 PID 2264 wrote to memory of 2556 2264 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8810bda43f7c6d90d35b72d6863119c7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2556
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b58167ad46190e13a35285c7f901a31
SHA16b2a2663dc5fb0d87958434cb08fc29381471408
SHA256edb9e5ed3d621cc2261d1aba3a9e0ca8b9cf611e489c5f9da4262888b037914e
SHA512c94d130924ede626358c76df98e5fafc0bb55d05c6a932b6418eefeeeb38ea6651d6268e486b12620591dfd7eed640150a0a05958b007ddc01372d9c7b5f94e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f37734813610f35b6378cfcf720378e
SHA1682e7b92169981c2bc8431a57a1c36e98ff8f2fb
SHA2560af2e746fcfd94928776b1f8189f51873078d654e01d6063361d54c86523265d
SHA512d8f9000ac8cc79a1e71c7bc4258af74ee663b9e056d9f6f99ed01fe9c265ef73614e4df47c7f6156a683fcae38ec158670289d3393b41e59dac581e41fa2631e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537dc5c1aa4c806d9a3c1deceb1435f64
SHA140d304372c078f95db1cc09fe5c11c095a75e51d
SHA2566bfb21aa56872784335c8a6d2a453805c67f4b5130b2f8bdfa15853b78e34991
SHA5123d05b0b1aa2dc16d3e14f28521e8c0360ded0b1a7727bad4183e129380362c107439543a6a92352b5cad73a8e472eece9e7d362299e626ebcdbd641b00cecf8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d306f85410cf3d87304ff7c0ed312199
SHA1b0bb53d0e270c8cb2c22789835fed60316ccdbd1
SHA2569b7277a6f802994e4a1d760ec7242f399a197cee1a97c520e74e78344423d6e4
SHA51227726b803710bca7bd02a197e8386393e181fb618431428d4ac83d84da15c99ea493f5bb696f6aa66c12fa954d89d0089885c03336dfa90517eda67fac228d31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540f8972a940e4bf9365ab4058ffd258d
SHA1075d36e4be47236985855a35192d61d47cc85d85
SHA256e2664078cb99f638e25cc4791714b2c646545dcae42c313e27a6135dcc6af9e9
SHA5122d0ab312da1a199c8f8015619b17c661c618533239ea802769db9d9848591d976fbb39f72e809f4123c36689943db13d2102242c57d8c2c773a2b79d0ffc3431
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521ae902e27eaa6a005bf6664b318a51f
SHA1587194c32ae39c8560e354d59b322991c312ec8b
SHA256b0a960752d53f5def8061be4ebb26cf36be455168a5ebb043ed8c231955ef68b
SHA51208efdd3aca28129278e1ca0b0c11cabdefce05e73c8cc29b3a801ae7d339d0c20ed1cffb13bdb33b20f7a307183f8f1b7b7daaeb92d1d7a9826fc32b8ba527dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534502bcc8dd2c79148814a9ae34112a2
SHA177c46b261c69f6fbf33e01bbbbce25ddbf31ed1e
SHA2564720d9b7b6fb4d5fae6abb51a3db8b82e1bafbb4c3955da43bd6a279a0dd30b0
SHA512f3a60ebb190986f70548a51b60401e1b84189d0d8c5740926f8ec9c2d9130503efccbae19e8f4cb7f7c5aeef7f7650026c6a6cd93fa4ef2b0d672826d79a325d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563eb2f08c46febca761abe4e9d2e8cc4
SHA1ad9f4de1809fad3ea8fa27d7c48a4341c94f6b25
SHA25645d44a1c06b3fd6d80bbed4df8f52f1001741c80deda758a634020d8c9cf512c
SHA512b8b5705a9dbb07850ee08a224513dfbfaffb112026f0c90cd71765427c36fe0453bb7b9dd18abf0ace30c2ff06e9fd353ee6d1f86c4d97e1a47c066f9d68185b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55066ccb0e975a1029ecb18804ad97e73
SHA11232036ae3fc0d266a14f6286ee7a4246135f6c7
SHA2567b9a7c1eb4b309e77afa9cc7f6ccdc75da4b079b1cf277496180f18dc0358965
SHA5123579cdb9f43d9a804be36fe7f3ef96c56dd2c69fdf8a05add26efa19ebc1c9a67875b595892d1f39b77d256ab632c569eeff9190e8d5e1df214b535a3471ed79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3ff1b60d82bef11273663de10cc9dee
SHA1878f500665fc2d9d8edb9bbf8c0edb23cc0085d7
SHA2562cfe5d34f32da5d49d91071619eabadb98e47bdb4cf2eb14922bc21e41b029dc
SHA512e297f98579044593d1d06dbb09a27e8a740a25239211566aef8b4b88c765bfeec24b36e4e859736cc6cba2618325ffc05f86215d361a1d00726068049be0688a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55dfd25ca83e7e455df0fe145872ef162
SHA1815e5dedbbee85c0bf7448bff92c93d423009559
SHA256c72318bc15cfef62a388d6aef03c28fbc289e9b1b2de20f4334ac94a40aaac1c
SHA512b38a7f94d8a7f45b68a04d9f99c1074ba5f1e80587439a683e9b64303f870f3c0cbbe1a015e90a9c1992691118c3819b3f1e4d37447501a175324a5cf91a5333
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee8ae7b47586a24ef9333fcafd1dd12b
SHA18cf5eeb10b7415d72bb4f41d06abca3701abb506
SHA25686a393006b324200a74fb609aecf2d6ff3bcf49768f41605c170fff07e4247cc
SHA512c99d878662e6b01cce6cc9d8cdf9528c4fbeeb46ed06f67ba63a8d895181a766db4c7447d56d6ce486f32fe59f8f41549044f151a392a48ae727a1cb45105e24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5628547b1729b3d552f61a5be0d2dcea1
SHA160fcb67fe5efed70b672e521196313c87ccffd39
SHA25692288ef69fd533a1d226abd83491ecf66338e371c472544671db988f53dab1f8
SHA512edcb6180e4f2280c8f86acbf6134be865f503417624fe827e1b4479ea256940ae85c763701ec31b58054bd803bf4ca5a4ae90cdeee9e73952b881848d05d0e5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584db8fc8bce766651d54e3080ab5b27a
SHA19aeb4a1e0c5c2a4ce3ded75de8209d6f5e978c0c
SHA256705d348095b4e4d02c618ece0b30f3fdbcbf491ffd27dc34f26f605038e3e73f
SHA5125a19b171e59809a53759367501849644523a52257e606ab7e971a4ae872f81dfe2416dc20c02b485151b050438045b4c2d93ec09412f17ed789097ab6263b9ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b77a8c7a593e0d57b4f23be9640c273
SHA1e72c43b5a82fdd751ca509f4edaae95e962a8e98
SHA256bcdaeae1d83c94658d7cea5b7df5ef38201a8ed183d3406d2dd91440efcf6b85
SHA512c44a056b8bdaa8610828375de67a0f3b5b2d89f12587964173dc9c0fcad0886994a13b6540fb7883f114d8eed64ce327c2a7291e5fd08ba7a016102027a7d524
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c8b5c24942610855466b501f1ab81c6
SHA1027b085bc90948543fcdabc951aac57e3c786560
SHA256627dcfbab825eeae9cf88c658425988d36408ac6c7e77d279bea285d60f70ae9
SHA5121e44b4c6ec9ad7c832315ec904ca6a2615ea460045844efc25c9bf76ac037d323e9750ea342dfaaccb99bbcbd68fe83b7033c52ca7924a87270f0c1d822805f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ce1714799ccbc5349467f530f6e83df
SHA1a242838acc8e622ad34ff189664565c285901a7b
SHA256a9211c48264386bba7ae6964b8fa849c8ce59914b79a3953eb50a901c78e3e09
SHA51268fd4f3aeafbcc07ed5e0436204cb15c67e63a01485a9fcfbfe7ec7ba1408a25c3529fbed719601fd1fdee642865868922851912315da0500852f46a4a87ebe7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a3f25bb7cb4522944811e4b83d6435d
SHA15060edc98b8f838d9809eefdafe8a057963e9e1b
SHA256384adbe3ccd7ff7c563abc31c0eba897cb3fbce5a5112c334d7a692d37a40526
SHA5123631344e12d4fa4c59798354791c74a2760e58fffb21c671312fb9b2dac69c1b3fb929fa042c6f3afc6caff1c981a6aba6b60e796a8065beaec79a1fd4ad40ab
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b