Analysis
-
max time kernel
119s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 18:48
Static task
static1
Behavioral task
behavioral1
Sample
87fa04bf197f0b59f09fb5c34836f567_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
87fa04bf197f0b59f09fb5c34836f567_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
87fa04bf197f0b59f09fb5c34836f567_JaffaCakes118.html
-
Size
4KB
-
MD5
87fa04bf197f0b59f09fb5c34836f567
-
SHA1
ee4ee4aeb834b5a2b2bd2c8b29a36a0fb9d3d362
-
SHA256
5f08afc3d10a787321f66147d6583b7b82e0b466c2bb256d8c205cf3c538c2c8
-
SHA512
e8fb6668034d53fd9754bd2d8bb682f62605fb1b992657e576672a2f4441411fbcafebcf26477f4851986d44243506a51f7f0944c6c697164eee5b36e7e6098a
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o6dXd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pD3
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6DEA3A71-1F7E-11EF-AFF6-E61A8C993A67} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000908d1460500d984eb991fce3f3f549d4000000000200000000001066000000010000200000003b6e5b9a8b786973f6468ace1ca2297e13e4c20523ff61a8a6448bcc09b42810000000000e8000000002000020000000da50e2e59d9fcabe5b38b68d5d63e56e586504a76450dc7bc5490ead6dd09a8a90000000e35c17c135b245c02f3da9dc2f219e71f619cd374ec6a10b7a710890153c3c0272973768042285ae6b37a6e0a801f161437828d06edc34ef6b17a3adb95a1f40eee188f902530f11b73a60479671f49e36a88242c3f2a7db5ab9320e6408cdf5fee93baddc3e147ec66511ef5ea1a74cf563c803dd2da08a5957e1c97870e221ddcb9d7a455a01729117769ec01f8f2940000000d86e0aeb2d7cb78d9d572d39eb93be852bb00b7d8c816a66508bf1c050a091d41f63ecab3a01bb0909dd105a33e55e323467dc7ba44a9bcedaabe36698509f78 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423343204" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000908d1460500d984eb991fce3f3f549d4000000000200000000001066000000010000200000000f44b18657260c5256c42a63fa9cd9619492526cea76768d99ced5e42e6bced3000000000e800000000200002000000036c45379b80c5eeedb70727abd9c623e19a653cdf0f437a1a44cffb152c4743f20000000dbf8fd7f47cc20e8caa3e760f7dbb4d2e66d7aec9b139d246ec2ffbb7dca4e444000000033f7dd0356d699051c065dfa7be17a08e4f3b48e9bd5fa3d0379e75b772b435619570fc4b3354f5ace1cc64bbf992bf6aae3a73559a80eef5aa0a374d20c763e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 501ede428bb3da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2292 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2292 iexplore.exe 2292 iexplore.exe 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2252 2292 iexplore.exe 28 PID 2292 wrote to memory of 2252 2292 iexplore.exe 28 PID 2292 wrote to memory of 2252 2292 iexplore.exe 28 PID 2292 wrote to memory of 2252 2292 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\87fa04bf197f0b59f09fb5c34836f567_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2252
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a30ce009436f7b5d0ef3c75139bd5d3
SHA148039326d9494c5722cfddfb708a6a8d2afeeeb4
SHA256da5cfbcbadfbbb5d61426fefc603643f0ddcbd9e32cc6e0a50048c5d942632f2
SHA512b7a31505bfa5aad8c9e0b3db44960398c7a0ab008729895e5c20c73a4b63cd1253b6510efa1229c2252151e0f085e00a869fa48579a2144fae1b5f15c48a02c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5deaed37f6b10cbfea237f10e12e09a0a
SHA1a1b02a476dd9bd50f6320963f911ca2f735fc83d
SHA2567976f0e6fb1eb5c345da1c965b3a71216268431748f4378e88ab7127e8076728
SHA5128d39502f8db9346a4354cda0fb8f35e1b4194fff8c717bf31a230b709728f597cf650b0f58050314ca20593d66f1d8fb36c08c8ffb98c390d737e355dd5da1de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513c70fb7277d0d6580dc4dbcecba6a36
SHA10efa6777f63768d88ce7393653ac29cc22a64fb0
SHA25678d9a321718c5bb31e109ff0df460bb904bb9c4d84cba473834a0a74ce483057
SHA512f39e0cc2895a30346a18a0c973d71b0a78746ca6f4e517ebf8525d14a66a754dc59dfe7c60d118f79dfb25abe5a785f2296a20240621df4db025afcc9d8e5c49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5604022ffad181b5998c5acb67041e231
SHA1d3d54fb5c7da027410aff1e5e41f15168f481290
SHA256286251d1ddd00231fb5092ecd5c32a65aa03c70969c0402864bffa44a659409c
SHA512fa3fcf83a9ca851c7679ebdee960cf87d65d5a9b44490b6061bffa1838fc7420458a4c9fea4b35d35fe3191509490ee6b6a0b088db7ff90a4d85250ca4cb619d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f77c319e3699e6a6af444720713743a9
SHA1526e63909f7642c2eb4bcbd06b486433b352d806
SHA2566b30458eeac1983c1d1bed8bd1fa0430417e4cf3d4a4d36b877c3092e2e60f3a
SHA5129e1f65076d23eb929aafad64db2adb9a83072a79de7ef56c4db65ab75247f0f7915c9a554d4493eeff102b1bb339a709949753522a5492bba9b2877835562eab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50815fb2389958bfe12d84e97825cc0ab
SHA10c6cd35d73133cf3d703db9e917f585025733fb8
SHA2561ae577371c0897e36f7277b041d106032e6059ae540a4df28f1819a63e2d9ebb
SHA512dab33ea02ae269817c33e80fbf3f915b9afeb133045a94afe06978f384bb887036834d9553bd94d925e91d2d3b4950ddd0ea64cf25c9538542415991800f376e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5264c91db8728e933997a475767d7d854
SHA18bb06245482d86dbf191c787a27701bc105ed09d
SHA25618ae3e2a5ef933246e4e78eedb7c61155411aa2e50281bc47284699582ee8800
SHA5123d0922e28f5784e6b291c78c3f17fb66d8014b4d29c0af581c355f9942dac8d3591a2148ffd73b6f8cff614f2e70084cf98bc0abd727acbc9d24f7ad423c6740
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559239aef0016eefcbc84e462243d9951
SHA1e95b64b1dfaaa5349b3affa3028242166a37a682
SHA256ed91810f1f714e7acf6756610c7e327ada253e48849f5fcf874bcd7018895350
SHA512d91e755034f8564f10dd3f26283ffbe917c6a5aae7820a989c07eb1405998eb1edcd4d989f4d41f6ac98848256a687148cecc65ac2a7c06e8af9c744850dcc17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd0feb6d61004ec522bdd6eb967c074f
SHA1d302a06dbd0942e03732fb58e4474c8b1e2d03d1
SHA256b9f38728b85c5e225ab604a8e7d5a4a4a79fd46aec1bf1813efe29336345890e
SHA5124eac6070818e258501956e093628929b0a03f4d6ce1e4607e19cf6826966316f527b4c3e47eff62219de87fc8e84d35b95af64874be3779d59fcc6d2cf2bb590
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD599b1a1fd36224d538fc7061edbea88c1
SHA11ee4108ce0745b4f5df74995a9980c62bdcef674
SHA2568da147445af939be499d536b1a9a97352609abab526fd49c913ab5287771faed
SHA512d50860256e4265186fe9e63fdeff2c07bbfc8faea51119ebdda9e9c8daddea16dbdd89662637c930b779c94c3bb74523484356f0f2757458f0718be620520661
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5476ddaafa6f31817ed58bf73afd15f82
SHA1be2cea30ac8c230ce6ccee32328411af7b6585e5
SHA256211b1d2d0ce90003439546b6f39dc5c412dcd397b403f774afef0f7d11ac4347
SHA512f69995089855bd7ffb2dc4fcf9d7382500baa6355a755c780f49cac29476f3dbddce3c7144a4e0cb9f62ea3566f17b6728016435746752c280d98fdaa7309265
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb33be22f0039d5a79cf8c50afa0e8e5
SHA122b83ac652fe3c7faaf92b1cd46f88e3f9d3bb5d
SHA25632118aaff00c3ef121bb9d4e6421de3e108db2f1b96d3d1684c37facb96c470a
SHA5126ae22ca71e12c5d2c21825d0d1a19bcda3d6856eabc9af11e7dcbfc7e638d4f7d838696fb66b5483434e44b07b4ca19fe7dfe96a1d49b9e871efc2be8406f523
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb0b44bb7679b87921305b0330a60d79
SHA1ac78b5c2f5f3d0a51744a8cd585d8a40fa65ecbf
SHA2561f3d4021c0089d36e5791190e86735aafddded8e7ea39773459ea12c84b79a81
SHA5129b829485753e9142d62dff3ebc871a05c996a899b305b769747246bd2d2632aa580b0c4b4f58d2ff84310afc0976284115b748a8dcd9826caed89e9cb72f13fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d84beb0720351ce8a5d7f80f024cae1
SHA1d365057394df9e0d32503a5bd625bc0f3887fd30
SHA256d1c6bf8daedd0ae7a736497232c420b5e3221b2a3743b1a9e7e422a5de1431fa
SHA5129fc266443de4edc84a115e060ce2b598a84b2a8f10d9d4f27150eca0ba0591a5cc5fbeeecb488a93e8f930d895a95691467f702315f3fb4bc3610acc5d12c642
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5095e70266324fa240953db4b1ea57ff3
SHA13e9bf6c1826c07425e94c30373b0bf3f34ee5793
SHA256a930a67f25965cca855ddcc95a86986ffde5c24db708b917b90e4b22ca5ab91d
SHA5121fafb9d9db55ecd211632aaf07b7f30fb2cf479ae529b506e06f556e8b07c6c4cd94ffa882a9dfd0e8dbe1521643408d6c6ad4f796d5b4c89581dc300dea0dfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5016fceb64de8cd910642bcd0e8f12cfa
SHA181a86440ba449ea501f45e4445cf598411ca9845
SHA25645498d27247f16178da198559feb8a70e0eef21ad1205ca01aaeaa1e0d53a6ec
SHA512c748921e191cf4bfb8decac6d02ac1feba623cf836df06900822e6f046f1a473af6ba5af6ad2ce3e151406d37b64317f3c50e769fbdae35d8bfa80d9fc4829de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0bcb51dfa1cc1ae50172b521cad344c
SHA1c6e542aa1743f952d12a012952723fc9e58bf67c
SHA256a30351d220d0ca19feb9e482c7a8c01df5e4ef7a59ff0ccdce3f0300288ab868
SHA512eee70c7ee91cd49c8a40fdcf14a71eea3bfbd1cbd3c3eebed1cc28c9a4da30291d27b7b9321d0550a18fb3e854831c931df166d8d8a4f6068654400a93b1d9b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b908ba3d11a30f949f4bbc2160643617
SHA11280cbb88b164fe301201a3d5cb6131f9e6ef308
SHA256782b34139c4f2cc846467e4552829321b13657aa84166a3c85d1846382d76376
SHA512c61339574c10668124becfc2ec90847e3fe9c094ee8c944fedb953dbe13b8665b352893dc631bd3e25f7a80305e9773f70f78691e8fc51e40b44902163fc1fb8
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b