Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 21:04
Static task
static1
Behavioral task
behavioral1
Sample
8f6ad3d4715ed2182b143d99365c55cf_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8f6ad3d4715ed2182b143d99365c55cf_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8f6ad3d4715ed2182b143d99365c55cf_JaffaCakes118.html
-
Size
18KB
-
MD5
8f6ad3d4715ed2182b143d99365c55cf
-
SHA1
2c9f7de9f59f6c60365fcb3e1ccc01b4890a24a7
-
SHA256
4842f2a98029c633e02e0e1815f5efa4f8d6c84bf030eb6b9488288c536c33e7
-
SHA512
719ecfb47bd47a8031b150dd3b0a4d57d91c281609c9c54906f641a6ec1d322dc4fa0aebda1d2716a30e4a52aa8f62ca267d4e10debb46596e1081f5d593bbcf
-
SSDEEP
384:RICQ/JkNCDFGtr5GK44sGF9Jd+cOJ15xs/NJ4J6fnD2U6wja:/NNCDYl5dsqd18MGkD2UK
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000a136b8e30fe02dc18a10c9fa17cbb18e95bb97e529666236cfd4e089b65cae2a000000000e80000000020000200000000f176b8797f24dae4aa2251540d9420542cd6d47f7bf6bb94be40ccca3054d0b2000000027a9112abca00ecc9bea0c398c6942da8c8121604e2b15ef8aa25b56d78c8aca40000000aa40e6deea37d377fbbf444bcec8f4516d81661b376becfd89e3ea87d67747e9bd54883f5e0e8705e5510921a476de327e364fd59477535222115549faff3316 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000f151ea9467909502124eccdf00c42ff9e8053747ea797f018835020538c416d2000000000e800000000200002000000081f83558f3e0ddfe6501c5af597d449b7adac3809921ca82be367541746aeebb90000000e216b60ad87d4c5ae765d10fb5b5549d4abc06585739f50a4b4a7c79c517124cf1492329ba1ccc48f0f32a91b8bcc353b1a2db46ed009771d833ec1a2223252f54fa246ed8d17c7d9795ba406c8cdcf9e721b13c9059814fc8db1490ca0605470f6ac20f5380757fd8640e93244ad426a6e39880575da433bcceec5cdd329dd8e5379136abea3b21e71a8e81d0bd45a940000000760478f80b054cb18c27ff574fa893743e11278b1104f93092dcb8ba56a4f03e878eaf0dc2b7a7dd39f9e4b016897203626ba863248facd9ca8b7e2200ae243b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423524157" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BF928021-2123-11EF-BB1E-6A387CD8C53E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d098409430b5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 348 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 348 iexplore.exe 348 iexplore.exe 2780 IEXPLORE.EXE 2780 IEXPLORE.EXE 2780 IEXPLORE.EXE 2780 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 348 wrote to memory of 2780 348 iexplore.exe 28 PID 348 wrote to memory of 2780 348 iexplore.exe 28 PID 348 wrote to memory of 2780 348 iexplore.exe 28 PID 348 wrote to memory of 2780 348 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8f6ad3d4715ed2182b143d99365c55cf_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:348 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2780
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f4bcbf20ea1b27c09def94b66eff285
SHA1574fbdc301d63acd0e86b605d68b4676caa5471e
SHA2567309aafb5eff4483813a8230b6f55f3cefae1205aa08d44267e33c2181f5bf8f
SHA51239286ae14e466d05eeb8417cf6b60598debcaac4c52676b12562e6cb3bc50a4ee97620b36da0ffd3cc07351a0701be9fb2363f279d074a2edcd0fc8ab093c2ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e0c52bb43c526037c977966e4f1d695
SHA194a0868d7522b29f2c287f770d5f22a122a6eaa7
SHA25605da3fc47904ea32489cb73f15171ffb12d57a12c2b5741c896e0c5465222dfb
SHA512831812a235522b685c9a7456e04b45f6f524d85ac8b22d938f69056c0b66a7a0343f4c232963ee123e7001116904e152f7925ef9ee1f976d1632fe26bccea744
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8db2d7b5dc78a3e86e5fabcfe0a5185
SHA1fe4624a20eb2dc7209d9e7851f6c981deb74c78d
SHA25622d2aa9ff1ec4c1121cde729f48d8aa9b4f36d989205ab7488982411bf48c01f
SHA51201e29e13e42cbadf109003825e4f2e665866a9824c64b9066d4a93900083afcfda039b32842a170318fab6738bf88a107f76aa0eab54c2364e4d00485b7eda00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5587de03c8e82d783412bd848d524b573
SHA147465045297fb1f3e1580d3c4110a864b889c59c
SHA256b813f0584405f69920ec5c3ac6d6035a0361e0a54ddc5907ee8702a650710dc6
SHA51259fc44c1bd08c750b5db402888bac8ebc8bfa4e545b5a639258cb5514b02bb767a3d692fca4a9a39981169a07dc82e245f1ecc97790c7aa9a76b630049db793d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5a04e02649f7f63802962499b344963
SHA1a4e586e78c6cc63b50bacc02e01a39082b3d53b7
SHA2569939770117909e422a730f365d012c3a27171fed7d6b1ed3d5995d61e4dff076
SHA512dd69f652a05a8380042a31a7d70c53f011c2470a5d79abd040aa495d50cca82ae6fe32514902208d7c608c33f9c7c10f5925d56b2c0b19a4bab982038e12b001
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54391b20d9e0d31e6978fe0c247ac96df
SHA1faf73fd0c290b1960baf2302e1f15e4020f19f71
SHA256c576fbfdd4b703f5cf6838c821890e711c1d30f2565f0850221a726611d22c11
SHA5126d63acd51176a97156644b3c96f5213a1638f99ed946c2f8502d26fc3455c143d707218fffe79ab50f5b75255023f02bd8f7f0acc7bd783538c616c26d819f73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5416252f38f64989fb4b11992c3ca0580
SHA1053e7049c8ef2e1ed5a449ebac0d5ee9301c5bce
SHA2565b03a52d42bd999949266ec93332c3c18c5d34d3b1821acf4f5b2163b67e1b8a
SHA5125d723fe2046eb810b518ba3d3916cb94f325e23e124a55807a6386f3525b2bcdb8357ea0462f4ea2e6603873b2a8f8b2dbd6fffccedb07908d7f5918b73228ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bfa42bc408d51e5a9678fc3b9f1dc509
SHA1f6d902bee9f520fb80a538b3cf69f7f96dae2a7b
SHA256c982433df998bf47db788be05a4c4c2423d343a753ec8289ae2ac067015d85c5
SHA512c685cd46aa2fe80aa9d6492ed646fff590c79e8f7b97fd169c61fad4e9ba6f6fc1925a5bb687ed49cd0f58795ec5e62eccf829e8e72b6c17c6c11d2c58483e07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536af70d2f85dcf26542e8e72f0a4c138
SHA1a223855499196f452fb177cf205486ee09c6f165
SHA25691eaefd0b1dc4cb7e3e9818e26487d0926bca3c3d50f54ed2a11009390b3950c
SHA512c9a49995a4c7ce1b31fccc9aec35323bdcf6e13ba4825e225f24dc61bc56b97ce02e95ea6a27b32312d8096facdcdb9104ac4bdcea3b269ef323d06faa60e6ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534213e302ea22d86353e58a6afbba839
SHA1cf541081baf56278b9c229016160451ea76ccda9
SHA256d2a827a7b9a602bfb2543ca922ae02a35ee07ef2246bd52cc5c0f3e73f58321b
SHA51239ba0f5595f6000a17064d0b5ae3fe4ffa74354d55b487e4066ffb8cf5fd368541d708f0a1c97e33d83d183656ecf6d6cebc226749ffac0c872098722532a285
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c1f7a3388efb910ea1def4f5f7f14ca
SHA113513018d857a6e623c461449690d8ff8aa38055
SHA25636b2abc25c616eacaec1ba23b87967c4725ccd5fb6f8265f2f3ab9bfd1e496ff
SHA5128826d2722bdc7a8ff24ae714e5972141556db44932720ace29b63ae10703a908886fd5151ae3ca93bc4670ae5d086daf7f6999303f87e3ace388826ed43d8f4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583ad38919bc851db36be48ac1ba4d807
SHA16b0df3809c610b90b5b3c4c4cea478fccdcfb416
SHA2569a635d977b6aff4d3d621ec7f66a875906a5459373cc7646cc9641a3e9a365bb
SHA5121c5268bfda54e41061d2308ca5006c0529f16650b756c98c90200b852f5a4f5d9f8a3429fdc9e38bf931c4f536841d3e4c32d4053a94eb63ccd92d831d4c764d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f6f0525387f864089f6bb1c1d674dda
SHA15b3da800a7b4ac1cf07b16d0c09c4a1bddbd81e6
SHA256581ec6a2ad4f0a20b898fb7a4c545a9f0db9025d2048d34007cff985724846f7
SHA512078a3736441f3662d34ee0e4c03b83eb6661a0b738b650872d61412645cf70bedda6b5c77c0dbc928d16d79bd1e7ecc3bce1b6da36021109c62a710810c25008
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be282c392c442c8e2aa3df05524c38ef
SHA1b67da9a527c7158bd8abe97e7f308b7393eb1ec4
SHA256c0a6c258892768a3040c2a381eea2e4bab57af6454de99fa589a340dc582c6c7
SHA512d4c40568f54138047710fc1d9a0f139ad00d8cfc50839b03a49ac0f47fbd578c58c445a1f76999f10d06bfb34446c446929478f5d61d46cab4c7ebdaee42fe6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1d3bc2bb37b841a7bde699098cb72ae
SHA19eabff1b804346297fda858f0f2d40db6ffd373c
SHA256d98a7cfb396d1ccb005794ce2445817311f7c2e296ad939e2137f2534899ead5
SHA512cf205d507bc8aa15fb15b2d4ff2b4fe24a73287ef7f359269f37f89dc5ca4f315b9c3c1a06fa40c52301bd0560a785dce685d03adc485ea6ba358a7271f39ff5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594266f3f462082e9e6ce464cefd162cf
SHA1123b2b21753322babddf859b822f3bd3d5630555
SHA25670b7e4340dab413655a847c0bf47c74316a7ba8242fe3e2e18c6ae073e0f03e9
SHA512c6f808eaa220a33cce3686ded5610fd19a45591e90ff1eae31115bb34539b54f2033824a49e370c1bf89f84a86813f778eabd561f4c2ab7ec93a9bd95dcb371f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ad7c8ef1770e69797ba944543a49f98
SHA1c8dd007e42c82cbe3f121f3dbc2506404a37e24b
SHA2560cbda786a8d0b9ae4d2f27a60000a3cbd196818cb9d45b5b653009765e625281
SHA5127ddd7927a63cd4af86f1fc904fe1664f4637c9d6ec95948f8cee9439e8bb9f76b4ac8fddf3529082b6686391fc0cf7897c8092eff31b22d6c39075e0bddd66ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5130451cea866697d300bc65ece48b8ad
SHA116ae67332b52a32e5d67994299cfcb4ebf5c3dae
SHA256a5dc333573d537fff103114a09625ff0923b71b02b57096d81e41dfcdf8825b1
SHA5121ace273ba1f72eb8c4ebe59044dd6fe779d58ccb5c726aeb709522b15fbc8f009d5b38998a6233f71ce10916fee2898a52c1863d80b5c22de91642e253ee5d32
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b