Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 03:30
Static task
static1
Behavioral task
behavioral1
Sample
937ff502f3f97c94955715b142f40c83_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
937ff502f3f97c94955715b142f40c83_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
937ff502f3f97c94955715b142f40c83_JaffaCakes118.html
-
Size
461KB
-
MD5
937ff502f3f97c94955715b142f40c83
-
SHA1
b2e5f8542993528a40926743892bcc07d56b583d
-
SHA256
633844e4331716ac1edbe2908671a2a0defc6cf50201ec4356ec92b1f1e1b23d
-
SHA512
9d90edf395d60bc83108d39acabe7381cb3a40bec419a995afbf55b22722d0f38042b627264db43ee17e41fdaf6ef58203d5505bc76901230ef58a093836e6ea
-
SSDEEP
6144:SvsMYod+X3oI+YrsMYod+X3oI+YhsMYod+X3oI+YLsMYod+X3oI+YQ:W5d+X355d+X3b5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80134c952fb6da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000797916ef06b548f6df3869f531a01cd1b852c46c86b0b26b03b8f67114f32843000000000e8000000002000020000000f490fc6042612357a2142fd7a76c359b33d930a6d1e10c9c4fff8af9c7316ce320000000561f0d8b300797a9f38aa9d6f87e9823576ed92b017023fe49b7c3371f146ef940000000a4265e77e72b2e6ed0beab5f5916b3a83f06c671615980af4b8eac5d0feb23e2dd22ec5cc0f3aea8f8fef0ec5d0f2b4354a3215725da4c92f070edf9febbd0cc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423633673" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BCCE35F1-2222-11EF-94AD-7A58A1FDD547} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000002e99da303f8866af8320995e9f9bad5ac2d0abb3ef08c87f7035536d2f7dba2a000000000e8000000002000020000000de82f3766d3f97260b201ad4cd65fa66b661c7b4c9ff4ea627a2d8feea3cef7c900000008ade41589899fdf231050cc177e0a27e3117f230c888e942b1b67058e6f11d1753aacf4d34e77e0541e1aaf9d4ececc0c4c10fc2019c4ae0ec4359edac59182e52c3687708364289dc3100b35b9b4d2fd20c8b526c01166f858d771e4bc1f74349fe3e7e0d2682ae9b0444f51608b856764fbb43395aa1cd446540271426276ceed5d423efbacbdcd71c7513d40bbef54000000019f930492c46fe19e7216aba3d12cb87618a722a14aac74f8dd95ac6e6dcebc65f54eeeab9a6cbb3d20acb3f1c13a3bbdade4cdf8cd43d0fbb54971de5ad60a5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2128 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2128 iexplore.exe 2128 iexplore.exe 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2128 wrote to memory of 1688 2128 iexplore.exe 28 PID 2128 wrote to memory of 1688 2128 iexplore.exe 28 PID 2128 wrote to memory of 1688 2128 iexplore.exe 28 PID 2128 wrote to memory of 1688 2128 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\937ff502f3f97c94955715b142f40c83_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e63e4b70d4d9bca2bfebf9ea21a9b433
SHA1d7224dcfd2af51620e215233d8fad13b15b3b95d
SHA256468a649e66f8f0ab8ec255e28ca21adb7bac433b885c68554232300762d68afe
SHA512e7083dd9d2e5d6528ef0681704f2d551594307321e0315ffd956eb6d6004536e4c8b56c4236c349f4e6d1bd9c3333b39ac642dc0e393842cc9c7dbaf8e29c054
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7d084ee87b9af767a9058671cd5f248
SHA1f3733661bd52e90c8994ad0406502dab4f3c76c1
SHA25619e05a6fed790aae8b2d35700f337fbc7a45fcf0d7e62314ad9783c53f162a68
SHA5126dda3a6b1da0e1a56e2dbd66424cb1e32373c89bb746e59ec5a772ce8b280e62dc293314f67423bad84a48820fb479c839348b5695e0dcbd0e09ceab621c4ea3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f4a62aaa3efac57ed0905984e40db46
SHA1fd37c6d678f0de74839f1df53c3d2daf388f3389
SHA25673fed9220188ed42e1fded1d579652853479f1513d73b940fc5d0e948e1a3cb0
SHA512f05d66ca7ae1379b7e66a253501e1b1d835ef184d6fc69294cd68f3285bc9713701d1598afead9dedc7992af3cdab36be498cc70e1b4b7d558574792e612aa57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57add0682fabe570f2e5dbdf846dfdb10
SHA16141b10909c5fa428b2118bb2d24f9ee3f01145e
SHA2566672fe554fa25a0fffdd33087bdf22cfba3cdf3c7689d1268601332736328ea8
SHA512ccea2e1ef253371ceac3ab6934ffe757819a9de519283bb3964001511114f03229915cae074e20f52d066325132cc798725d282f6d16a1016a72972a37e0318e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561ffcdc67cae3ce4ccb4b0dbe000c2ac
SHA1b2356a2a34a50e7e02b9f8e802a5523598a8fb1c
SHA2567cdd312e02f97bacb7d983b67832c0bc8ed85e2b0d0b61f0ca0ec1f985c8e8f4
SHA512f9b66fe25c799eec3d2f78ff0c8e9eca2e8feff769e28c48deb211410f0ca6a6345bd2d8079824b52c36ad2df77c2935f76ce072e55cdd7d905b4ccab499d986
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae595c961c91e5eb1a326a9a5be41a46
SHA1bbd6199c396753ca3e694ad119e97d24fc7f73d4
SHA256ed9394054ba22a3e88f2baf815ff46e60997fdba4aa53ecbce198ec0c490a7be
SHA5120fb2271b8280f1e6c8cba36c68c4269b79e5ee29aaad70be9f2c0e73ed81a5c987b55603fb09c86800e966f03cff27b8e8719b92238f1fd90371bb45cfe63d64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c691b8a5c94fa7bb072dbad237b647ca
SHA14ce978450ea056a3ad081ed4e4889c4e4adbb760
SHA2561e27dbc47823af687b7aa98bf05d80a298e07f890339015be8c26ec093cdbb56
SHA512a348c4b4972eb8379391d3479d2fdfd125478dfe552f010c5e976698eba4d3482ff30531309e5430ac537345789d486666ffe28b936c429bddfda316b492e765
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54566e4acf4cd265f84a01cda5bf83de6
SHA1caee710d9289336d81b7aaad7f306f2435feabc0
SHA2564d31b659b0d87f56ed73fd8715f497b658901e44a16f080a6188bd833d0f711c
SHA512b95e0cfe19905e0ad9932319451fd479a498441e65a7d82416741857935fcb140bc775bbfcca2e6612af359ea40e88ed48333c9210a4fb1e663a986e256814dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b510bca7d6f2d566c52c5bbd033a4d29
SHA1d102ff867fc01a98665046713ea4f17994879de7
SHA25665530c5899ee32e5cf1ff5fef369f025a2f8004325800b48dcd9b720bb768460
SHA512de1c6002f0df07768a0c126c03d1b4895ef2622ecab537bce9af8a8e0abf20633b053ce6c7ba46c39ed5c9bee1dd8d37649636cc40f89858f75ea92c02b9acc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eff69f84b71bbb8101accb767bee73c7
SHA161704bf863fe0990bea6c3ee8c2198d3e2db8a9a
SHA25601fdae94e3c35bbf404d6a54b226d2ac6c907beddabe2f728b27804dedf3e085
SHA512944f0d0d13eb126e7c7ff0097b61714decabb47df7fa1caa3338d5439d78bcbe8d1d2392a185172e9d59576da27f2a423d7bb2dea01eac2a476e863a9d9f0c3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539f3abd00c12e9672fe615daf924c78c
SHA13f805916d9378406d3b72eb995110fee19c00ff5
SHA2560f5e964eb72e86d640b005780df3ff5e53b2f82956ad4c52a39e940fb086551e
SHA5120f95fffaa770e7fa5fc0ef639fabe22e8c4afc4cd737f816af9106f36b8440d30f5da209b88c41a4fdc3e2268a4aea18dba826f0c6402ec626fa4b6fdbbb697e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed2b1f1f2c9f535ca115ec2096413a8b
SHA1b491b33d396179157deab9901e681ae4f1ee377d
SHA256505c780a8df3f3408daa8384c6e50638b6c4cab17e7beded2743df3f8379def9
SHA5125609a357750bc4f587057ca8f39b42a8c3e5a6b47e50ee92e66545fda20eaa90915392a2efc3a5642255189aba7a4fd651148143a83395152600c09145bd23b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fcfadeca9ca7dbc43603a2105a2a9251
SHA1cb8a8c1d2cedd2a0021c46d50991177f6fa491af
SHA2568fcd2f85ea992dae569c7062396d868b1d83825920552fb4cc325d63d354db03
SHA5121f734cdfaf09fd7c7673485dc25af1b82cb2b9986187c9fe36981bf6d4249ee67ea0ef7042df06f0a41e28e2f8e7a8d35c4d68e2bc8d3e6fdb1386e15f9e7bbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD599cda1f0df2937abca35fe1d4d2865ed
SHA14c21001d6f2de38dd6aec738f88d81cd664c77a8
SHA256edf8e4b6f9dc6cf8f9c6dbd96766bf1c841888cdf3c4b21d25c04047f6d2b1eb
SHA512d5161de2adf430f255689cf5a41e3f8db5be40e6d474c58b0e292ba18e2ad7c39f8dc929f63f4c07d894b8805ff4890a458249f1db943b91cb1cdae9a0f1816a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e82f1d64259315e2eeb5199c6887c6d
SHA13577ea94595bfa1a93e8dadbb6b397993fef9ddb
SHA256e9c9cf5110ddd216e61d3f0b3832c40a530a62bf5f80b2a4c53db76e9c07375c
SHA5125c0499f18c85f69339f02ee3674810af894d04aa9826a775969b1683a7e08a6e41af9bd20a544215dd17aac422997a810d4c837a590a1e4c75c0afa126ce8fd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5086e8347f648d13e04ddf55bf855591c
SHA1feb8c4774ea2c44fe0060651e670fbdead46b2f2
SHA2560fdd0c1ee69fd56e41881d632a1985e0153d65f0f1311f081e480d22d623a4af
SHA512b39b6ee1b3889f6d34c799b0c17f860308ea11fad10028806f8e9383186d24f6780ccd7fa09ca6052e57331da9702260d2e96e768665720ffcaaeba7a336bbd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5ac0b71a15b99881802923e54076a8a
SHA1f257760c5f7280ef990afd5e749aab05c0ac5344
SHA256d0df08e6f835b36c12b76c64324237b6f2f02066cd8a25f94c7ba40048cf46be
SHA512a46eb72e493cca2796131a01037e3f41cd7cb8d9b24d415318732954a96a32ff042a7875f66ae10e641f50ddbe0f91273a250b64cf47f88f928f4a212c1010af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5346d79d8d9ced36c0fdf7292c0affaa6
SHA1efe3fc4253808f0a9682c51b0d5c94661e36dc0b
SHA2563e45d32bd569538fdb520a4610712f128d986a6e7e56b8c0b670db4b978276ca
SHA51248d73e58ec98958c8e4ec47bd220529d44476f29724a50c3a1ef5e578ac91462ab6aa3abac75a67153edfe12c4835a08412a084ff9e3d4024d184545df84d217
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b