Analysis
-
max time kernel
117s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 08:05
Static task
static1
Behavioral task
behavioral1
Sample
910d5bf4dc3b69d9475100aa5bc43745_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
910d5bf4dc3b69d9475100aa5bc43745_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
910d5bf4dc3b69d9475100aa5bc43745_JaffaCakes118.html
-
Size
121KB
-
MD5
910d5bf4dc3b69d9475100aa5bc43745
-
SHA1
a7d4048682d1d11d3964e9c8e58f25f7aebe78e8
-
SHA256
17005508921a5ab90f803cf9244239bc78c1a042109b42f22d220298c8ae9e11
-
SHA512
ad8699d57c34e1814c640d710dcc241a7d44e9f558173852f5d7b89aca4c8a1294c3466754558ec7a5ac3900599d41f9f68acb56d1863e19d288aa701e9c825c
-
SSDEEP
1536:ScIgyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCW:ScIgyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D3EBA81-2180-11EF-B44D-5A451966104F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000006ed8818f3ee392173ae12759fa8edd7ecd5f4b473bed983d88a91e7729ba4fab000000000e80000000020000200000000abaeb7145db9cf69253ece568424d92ed97b47c7bd215f440fece8ff25443c8900000006da9dd8eaa77635f2ce358ed699237e8cf3c5924bfae6d7a9190e342c7ff4549a6ce9bd7ca09a015f438b9966392b457c02a3a008b1ef39521cbf9358ac9ad0da613332a95a6af3897d91debeaa5d9a258c014cf39554903805133786af6facaa080281634f32421640669ca4925ca84e6da8ddc6501e94fcaf06327e62442f34141c0aa75593922d6e3f06e95b19f9440000000d5bd2f873ed5fa0d573c115e2a4c482cf92cd28cb8530dc46b12a4dcd405d77f87646b2f66c9081c4cd68dd9d04241b5416d85d205ad0710ee5266340aa59bdb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000002a8e0d2627587a643f193f490d20062abed0beccfd95c1b5d4f879079fea6f75000000000e80000000020000200000003b99ccde8d377eb0bb9a50b6e96e769fc282cc1970b6d2d702c373127162b4042000000049eeff3419af849f73fc695d87771fd736140b2c7e48875a07337fcd6923afc4400000002086da7854de02ca50963d6be74f50257ccd8bb3947c014303392aaa922d62c54783baa30d378d3215c3ef3524af75f11ef251a129afef11af45c15db2414341 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 908ee0e18cb5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423563812" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2952 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2952 iexplore.exe 2952 iexplore.exe 1148 IEXPLORE.EXE 1148 IEXPLORE.EXE 1148 IEXPLORE.EXE 1148 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2952 wrote to memory of 1148 2952 iexplore.exe 28 PID 2952 wrote to memory of 1148 2952 iexplore.exe 28 PID 2952 wrote to memory of 1148 2952 iexplore.exe 28 PID 2952 wrote to memory of 1148 2952 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\910d5bf4dc3b69d9475100aa5bc43745_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1148
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528f77c647ebf036ef220e1e6c0dd2ec5
SHA1b0452fc11144cfc572368b2c9944b6fd04d6b11b
SHA2561245224e2f1c8effc37ad6fb73257a8fe6b6e05f83509198d06f7dedbdd0a511
SHA5128f63a568add4274a6ebfbaa3f282d57dd95d0a5ffafc9e2f85e4d9795578d6ad8102012402ec443e25c7a0260d2e08933bfe247d7cd3ebf011d557fa877ef378
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6c95b1039ee19beed80a2fc9329a1a4
SHA1129e13934663ebb78a966e86feeacbdc56cb5322
SHA2561d7a337149a7108b94d562c304b483b2fd4e158bd0848aa0afda37e0a984d101
SHA512be8eac8a0c8d6b3d104e4b8c8a918ed726543e2166a721a3e2fe1f9a218a317ffb49773280e4a71f9edf1d5081d5b3d3e2ef00ff87e448500cbc2d7542c05d39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af193381c97b77358f2fb842311bfad9
SHA1af1d713685a5903487edf66095980603649bdc1f
SHA2568bedaa3f4a6cb58b94cb5183f8f36df47431a16e1159e63d1f59d462d704b972
SHA51223a88df52846e0efbc524044dc207fdc54a53fc00bfe8f4bbaa044238ea08ff7d7a1c8985033e5c4731c237fea2b47c911b5bb70070fd77843c1670dfba80578
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59947be51db2184e04deed8ed3f609fdb
SHA123c2b945d0b2bb5bc82f69538ad08b483ea8d2c1
SHA256efe580d59cee034be38ab9451981c9b114ca8ca2155d9153880167a0c5e8da96
SHA51210219a932c5bc62c6374c23b15caa52f0c26804d940c3d6a5b96ce0dba757ee7d9edaa99338ce56c8877dba591d46bacf6f69ac6b37919ca83576f5cbe943df9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0c3e38e8fc925334213067835df5dbc
SHA164ce4b4627bf9b802bb4772b1baf55ce77ac96f0
SHA256b4e35329dfe3c0bb5d9d8a308787b4128e33e6a7c7dcf9e60fae293a00490cde
SHA512c73369afbf898455ec8beb0e749885daa1f47cfd12a598b753ae137564533518610f893392c4757e0ea322bc2fb8a090636e5376ec66298dfbb4e34f55133b9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5333d488aca3ab1229a0df1e4cdba7549
SHA146bb693d668ef88961b0974bee46391a22bc0536
SHA2565a25aead3a1afed35815c80f09b42f7be95dd0916c5425e522faa2cac71b4e84
SHA51277132f121bb2dffbbb091038def8a3fc9f618d0be0139e868d96405707e0983016bbeed81dc15889ed10834db68204479893c625bdba7349ea4bd15ce987635f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5675ef7018031a7c8a22a594256c1db5a
SHA171b0ea640cf23ea8878a2fd8fc90b02d3ba902b6
SHA256f63aa0a0936bda6430c4044b3a8ff3a726043aa418bd9368613d5ebff88685e4
SHA512d41220c90ca3d4c7d992bcff76237ad29e419c61893dd81e29de50e22cee0a574b7ffaf41c2521450bce36f65ef5df1235175f6773a61c2062c7e5b3853b563c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e9b27c5c8501881fdd6d7c5867ee7e7
SHA164ef56fd6887e859ae07dba9498a62a0cbd90cfd
SHA256f06eb7be8fc45eedd8bdf7d1f49f1d00b76d41fbae9bd54de047606939ebbac1
SHA512d7e5f90bdd7658e5cf3786c66a63b00ebcdb838e4ad1b2bc9cd4e282edec138bff8953e37fa4506f34f92e4701a6b146dc09cc980cc037ec7448616b24af1852
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540cac5cc0cea490757b61e6518388992
SHA101746dcdfb0414da25be96b26ac830ead633145b
SHA256a49b4c4124520ee6e7c579de2fbe5cef70c80e11dc47326d7fa8ce734f3b9990
SHA512e1f512481c06fe9430c52ec6bb487d19d93330d3e4f686ccc7a7dc1fba5767bf1d809b1d61206b6df97168a22989963ac8f44e8bcf72196b7f7812401170e253
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b