Analysis
-
max time kernel
136s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 07:23
Static task
static1
Behavioral task
behavioral1
Sample
93ff7df18d8232715693011ee14d2fba_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
93ff7df18d8232715693011ee14d2fba_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
93ff7df18d8232715693011ee14d2fba_JaffaCakes118.html
-
Size
13KB
-
MD5
93ff7df18d8232715693011ee14d2fba
-
SHA1
10a61ccd00bb8e1d5ecfa2f2d727e49b40c8ac13
-
SHA256
6b3bf1c1795a059b066f2320b3f4a7fd2a33f3d61efb0dfd5f7317d46c485b7f
-
SHA512
fb275e03f29d69d8978f0c9ee4d845e0385af7bf4cc114a2ffb93eb5a66af787d5ec60ebf6a9392ab4ef4c86d2e6abe7d3d723864c2283ae47358f986ded895a
-
SSDEEP
192:Cyiw/jqC1u9rkldrqCnvnCkwQFCVCf7f2uv6MJ2GA3vp4km+tcJCa4b56lV:CyiwbqW5HFOQFAi7uuv6MJM3vU+KI6V
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423647712" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6AF0B5C1-2243-11EF-9511-66DD11CD6629} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ff814450b6da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000038624204e2eaf7428fd95f3c06032b7f00000000020000000000106600000001000020000000e49a8b0d789cee5a758aeff559b4679f3b6e522c5a635fad4714902ef2de438b000000000e8000000002000020000000a323707f1d69bdaff50942e3126e80d2d71bbaaa00ed875550bad2be6a08923d900000004a786181a3678ec882d1e00164da8268cb9b6d6db34dc83f8611df0a2969a278ca2d256164ccd779c60675476145993edbd0d3c2edf891ef51c54966538f57bd6023e66fdaaa5471928d6ec16a2a1ac52817387c4afc86a75cb6db20636e96f433acfa9015428460312c71c8b45d61f6d2ea26831ee5a715b8d79fef6f8ffb180dc37a41e6f377588e3bd917c2cae1b940000000c66fee7dc25dc1c9269063c17a4c254bd992d1228af4ac568c810259e6489aa27bec9739a33639418753e4cf0ff5794302c8fcb7ace9ea72fddc4cf2f3fa6a36 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000038624204e2eaf7428fd95f3c06032b7f000000000200000000001066000000010000200000006ef3c8a3b72fed41f8e3f35a739f94e20c2cb1a284eeb72e3c963c9c78385bf3000000000e8000000002000020000000471d7454a1825579bd2fbe6cfd27d272ae7c5f686b79f7a0328fc60ce7cff49220000000b7207b934d3d0b516add8650a2eb6e0a70406f4fa52a153020ebdd354d1bb0e4400000001d1986a67f5f27d7beaf9151e52107e9bb8a24a9e7e386d97aa48091efccfd848f7ed066a664ff5281cccadaea26fc9533e912bfc27efba7c96291275233c939 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2008 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2008 iexplore.exe 2008 iexplore.exe 2236 IEXPLORE.EXE 2236 IEXPLORE.EXE 2236 IEXPLORE.EXE 2236 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2236 2008 iexplore.exe 28 PID 2008 wrote to memory of 2236 2008 iexplore.exe 28 PID 2008 wrote to memory of 2236 2008 iexplore.exe 28 PID 2008 wrote to memory of 2236 2008 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\93ff7df18d8232715693011ee14d2fba_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2236
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570292b2720962e6d4626553ae250fbcb
SHA1496543d4e94339c5636b3f0dd055412576684a64
SHA25666bb5990a50649e08131274ed5afb518ea0d3fe4b8f7df67ef8ae2ea26ee4be5
SHA51244200969f360c685b312d5621bb1c09142cfdf105492f4dd3c349b75d75eb6faca3b81975c138089722e365a766c1b7504b4eb2785cb4b1a0b7da50c7640f59e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577413f29b2886fe766bf94b8746e654b
SHA1e19777d90e3a96087dfea6c5ef3c72dd1dfca9d4
SHA25608358e16ab662b3904e3fc931da752100fc34f10dbf665e163d7cbdb2697c84b
SHA5129f801af0aaf092fa4a782e3debb38c3ab0b96472e2c0cd28ab61168ee9c6192adfb43d209f443b7ec6deb5485d1bc34c1eab12b4199706f0ed3e3390ebd5782f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56dc49182646c9faf4d7a8bba47ccc78d
SHA1f33b749baf834f27ff2245d9ed32531d1be8f1ca
SHA25649af608a02ed2ae2ad73d958aa311921b9e562be9f81cdeefb8f82a715802a8a
SHA5128f4ef1288e6a1a979b1d94b2e78885c28788907572ca242157ffaea7cc4348f82e078ab62239ff2021ec19ce318ba6ffff5e26df4b09ee16daca636dcf48f9b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568992ccf8ff156d19a92ef0daa59ea92
SHA1cb29799f15ca14a5c4b48a087322d7aa2292d918
SHA25693361e8850d8cec7e5770919860438f825accc4e6b6755162334caa892d0fbd2
SHA5123572480f5dff8f77f72141375ee360ae43d5dfee0b1ffaa391d3bf24a37b79b72098cffffb953cb0b43d23839befcb2b1a19d1522786d79228f0a54c8897ed70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6782e3d809b47e3b2c2a05b39a1a29f
SHA11060453440c1c4e93bf59679a042d06e1e74c64c
SHA2560131f168e1f53e040301095a64489abcd6ca942f4cca3106f97ea800c3045129
SHA5122ba40c4ab6671dde5d7036a1daff492b62a93cd380a9b9b5c3b54d3c6bec552867c2dbca7f4b128c3dc529d880746a8a69ba2fc89b996e2f2f361f39d50bfae7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ad06ae652cb5bd314145452230f861b
SHA10709149d5d6a18abc6e3411498ca75e2a9c08d4a
SHA256fd57e6705252dd7d576d70a78e37bd2c2fe652723e8a954062ce5872ede61640
SHA51237799e3079141534e1011f77951c7faafbb95c9849703c72e87a11a9559afb613eef045933bfdfe388751ca493595507214877b2ada178d03b2601137022a7b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc9dd85cc0ef54a2f3d49e1bda184918
SHA11e2f0c918421e105a6ce1f2acf89a73bbbdd02f9
SHA256cffddb0a69618102f7ce7f515365202b7829a826bf191a3e6ab852ad61eef719
SHA5129528ed9ca9621e181ddb7ce80fcac7a8635333243a637b9d25cd4d9000f62d001d7599539b52d4c97d503fa22336a9730434af588bedbc2af4d3243bab14620a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f916c570c93b31843fbd6f4acc20ae9
SHA1386e04f25570ffaa0b247607b15a48e419b693aa
SHA2563d05bc171e83fc4e4b89a16fa1ac4d12bbf2a6da05bcaa06f5fa4932a97ad253
SHA51289ccafa63b7e3c69043ee7cc2890ff39e55bfbda5f710303769e1364aaf2666c0bb37627ccbba02b1e9e55c5ad263740ce2596bc4b7c27e14d17773e02ca8bd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f96d5a432efa4e90746653c931870c9f
SHA1c2743ac1267f8c56d709bfe09e8bc9a132e0e49f
SHA2564f10c87c0966a27f2f88cbadc8083537620e39069abe4ab7c966a1a7cc893841
SHA512af26520c20396aaa2e3d7e9e438ecaa2dfab1fa980c1665a864294a3308edebe0d63b4d58d70cc680e2e60df78365397f258b6703be2834e4a70eba2cf779d34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b144841a8d64ac85d3d8b6e3a6c3174
SHA138ed8b5c4cb12ade5580ecfb7fba4d80a0c1e44f
SHA256b6cc40ee52ff83820e388007738ce47d60164678da2027f1b29cef8f55b253e8
SHA512d5f74721cb4596979b5054363d9ed0f03d05e23711fdb8d9523ea98f7a5c70de3893bb43550ba717a71838fd74d1c9bf704b35c0f09deb18dc4b62514a196919
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b06d0c5630c07add639d478b6ff35c26
SHA193bfac94875c098e2590d93aa2ae354eb76a2905
SHA25637820bfab5064177824a80242d7116a171ffd7287bb2d80c983860d6092cf567
SHA512d665ca9fa022d4a8c23fbb01957d8e6d99620b8dcbfb43b0875daea558d5b4392c1fdb855fdf4d3cb4729c6151171ead4d40d6551d5dbf717d0d10d11345f7e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac41a5bf405f5cf5f28bbcdbf0029765
SHA1e20565e2910ae2b06a19b02ac2f5f143c10fd2be
SHA256dd5c18d04847447ae330bd580e894df113e0d26765f787f2ac28be9a37dfe262
SHA512ec9323558321d9e31ea171b32bd1e632b2a9f2b2114e42227b21f02ff4416cc7890d74f93700c07740f4d3b764fcfb51865392c8c6a3ee0bb737cab09acbdecd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5278d6f679ed21413946b32c36ed79db6
SHA198760652c6897970ffdd6cc372715663b9b173b7
SHA256b9dbacdc77b8df97d74df7d1d5226e60cc28c445820a01e592bd07736946a4a3
SHA512c2bce0448f787e69e52696ea459385d7fc0e2aaf4c9c136698bf9f05d464ee8906dfa9db398613fbd8cff69313c9d3af2ca5fda51466dc44954bbb7502d2508f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a0eab69bcd48a8e7c7f1e55575fac9a
SHA10654b35f33b4ecfa56afc7959e21f80c6f355524
SHA256412ee9147e3c9b3b68dadd338a38e2897015d7b6d61ab9e2fb1b6970e57ae596
SHA5121f8a5a9720ef5b0e8bed26b2d9bb47a2de613d295ea3f0904ae99708aa72939e9e3d8f371a987f1e064174d2c368b910de54c178dfc891e1679803b5e59e2779
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5779c29e7e54f13c8de9c6ef65ca1066b
SHA1877001cc6d900f523e51e712a70e64ae2aca78a6
SHA256e422a68c55cc0d61ca261d085a90075c631b377c60255aea8e7beb8a2219494d
SHA512bac4de8d41443f9beeb22beabef535f5fd20b58095fa230f324ccf3d17f5b39b53b1019af884765a20d57ea7a152e928b259e09cec1b4ebddc2351e08350fcb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b272775219e4bff2f96252e84f8646d
SHA1a389ce5d9a12894215c7dbd64b81cae46c6613b4
SHA25627a7d08bafc366463f3b9e0f18d892219f117a25d74fff161570f33b2fb41608
SHA5125f9bef719ad0d0041234cccf515d963925cc8131b1c1ad15a2e31d329cf26004d6fc649b129321bdf4db359e93820120e05799cc83bf982b7b62f8c41e896766
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58aefa58a9b02bd701849f3eb36b7f432
SHA1dc163d91d479a60029a0a3e3107803c77c0f3d6e
SHA25639159a0a376cc78d02b53d6a80deb7ae465e00f78d1174deeb27d58255f9164e
SHA5127f0e9d3c990df7b9d5b9e9eb9296a874a412f2462b26e491f8ab40a6082c6878a4e4f9d72da6109e23638ac7de2f422d5b6e552c1dc2114ca7dac0812b8bc0cc
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b