Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
05/06/2024, 00:42
Static task
static1
Behavioral task
behavioral1
Sample
96ca1f74e8dac8dd006b3cbe90d014eb_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
96ca1f74e8dac8dd006b3cbe90d014eb_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
96ca1f74e8dac8dd006b3cbe90d014eb_JaffaCakes118.html
-
Size
69KB
-
MD5
96ca1f74e8dac8dd006b3cbe90d014eb
-
SHA1
ab5643ad0195fa3c5388677a78337cf1136d1c20
-
SHA256
7df1e0511a7df679a4aea23d7b158039eaf1a3074550794ccecab0a3437050aa
-
SHA512
ecc3359a9a7d8f122efcd01567db8b3258026591c50c854ce8f66c47c8c581b78b945a828c32fe005ce7e1c6926a977594328aba021c48e1b9852d1d5ae72080
-
SSDEEP
768:Ji2gcMWR3sI2PDDnd0g6sN5coTyZ1wCZkoTyMdtbBnfBgN8/lboiGhcRoQFVG8sB:J8zTSNen0tbrga90hcJNnspv
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{85B61AD1-22D4-11EF-AE65-4658C477BD5D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e005695ae1b6da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000003d3836d5e03ee3ce2f9e9afd3b898313cf8a7b6cce1664a65a909df8a211b580000000000e80000000020000200000003a19364706a03c16f964e65f8badfd48f6e7f5d1d311781487503a9ccc8a96b2900000004c3e2e0e3712b0c1a6c7a6aef64cfd7041a52aec27ec437f0a888d4f6c563c24cfb87b6174778899c087ff9e080d81450e01d44e0563676f0741c647b911bb5ef145cabbc097598a19909d4e83d3201a4dc6029e27fe77929155afdd9375066b99d851431e97b1e6e4dd5969d3780b9009c6cdf1566b35cbcc45bbcf5a5c566b0ddcb9d93e5f696b86d07fdb20936836400000006b8e41d71f91d085238e83f747aeccb315e8e6546691952934da0271bf157278274f4e846e80f51152ed7db999d0b6d37976bef9de020eb1d2c0702dcf13c948 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423710031" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000f75649ab0a743e68e62b302170846f8c2e6c5e931a592d4a3c1ea761cefce0ae000000000e800000000200002000000021bc3c89bb0e4900e4de31663056b2042a6a1f0561b89a06397cafe773aa882420000000be6cd5975dbccc673dd610b4eae591f4cd9ca18d011184abe3fd6baf7480326940000000c596a418c68753bfa2e7ec995248e631b43018ea76baa37b1129747c3b1a4f587bd4750179ab50673d6cfe61b72facac4091985e9a2e95297d3b9432c5bf3a18 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 616 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 616 iexplore.exe 616 iexplore.exe 2220 IEXPLORE.EXE 2220 IEXPLORE.EXE 2220 IEXPLORE.EXE 2220 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 616 wrote to memory of 2220 616 iexplore.exe 28 PID 616 wrote to memory of 2220 616 iexplore.exe 28 PID 616 wrote to memory of 2220 616 iexplore.exe 28 PID 616 wrote to memory of 2220 616 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\96ca1f74e8dac8dd006b3cbe90d014eb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:616 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2220
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a848d9095af26af47ba63c0a76e13c2e
SHA1800f1ff6eb912d3aad70b41b68c4a93a6d4f0c7c
SHA256751e8b5b7e0600d41addd1b7242eefd7e427e79b5ab6ec888cab4ced4610c106
SHA51288ac982dc937810ee1defcb3023ce409427daec0582b7fea786bdb52720d0ae4112f492665d692df4651821840dbd931e9f27b8e5f992cd9ba7b0fc169032aef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cda14c565e36acb593d0f707034aa07d
SHA1cfdded2aafb109295facdd5a5c5305775662c119
SHA256bcddcd2f1c4ef982eb35b10c5ade7e6c7c1a886a624d42aafcf59d6272b22bec
SHA512498e69bd950ff6476989980763c7962e0213c14164856a070a11102dbe689866cf86bf57ff55fd61d16520a4249656062d151f02fb2e1c686dbe7b7caf139edb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54fe1c15c78a266f28b7c0c18c73dbd00
SHA122f242df589130c0de02bd8c7a9717b9dbe4e8e8
SHA256eaba12024fd0ec4682517cd005e24099f2374cac6eb33a3c61a690c43105c59f
SHA512ba828acc510cb6768faade52bae83ff3f9744276844ebf474f40789c25c3b7fe70c1e6b1ff735a3c99975d4b4e543c33cf2f4a3b643baa7daf8c9094ebda0771
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d96f26b94c0ae965fd1b5e067e8eef54
SHA198c36a9d0e7487c47fee09e064510968629e8a4d
SHA256b5415cda5efdf0d081bacaad9bba1b0d54a73db8c2036a0755b0d9834f09b513
SHA512592faad70cdc6c3096c349ee8661788242337b546de9679fada2e14547c5c78b055aaeda392b1c92f9db19089ff9518b3a3e1af5a8f0c7c62e5b9b12d0ba40ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7a6b2e77c1344c388f0c76ed4745ef1
SHA1e1a0051b7b47e884ce22d41e7d87aab705042035
SHA25613c76efee57330ebb11e89d2714d0f7ec4678148e3273f32c6d4283d01386f45
SHA512a83177cf75f8a7d8da35ea7be950616ac02694f15d0d9bc8c33a7952e94f1549f5701fbebe10d5d2a526f9ca395cd67bc872c01c568f5a28b93511e7efa97755
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc51516e5284bef4803a3ce0a7eeaf8a
SHA1b091741b3b9bdfa074bfaedc5de0101f4a7cc350
SHA2560011a296ac46d44c088b930dfe3961132016e03c8b76562fb96d069656580fe6
SHA512b02d73cfadba96e5b50abaf6d46aa038389132f4ed704bad876bde2160e65406e942a665bdc15e4534463a86f97a56ce8a03e6bd660b08735016b99566fb8ea8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6a87e6c8d8d48570604e9002abf6ddb
SHA13c1f53cdaaa8b7d4d7101ea391f27fbe433882a4
SHA25699d2934ca4b5295817c72b33ab0272596121bb26948d1a12ac9f3dc7f114bc3a
SHA512d2be83af22e7dae483cffb5598559c90c7675cf9346d5ab1a3b6f29f254f80cbf63d9da314a2e8db72a0cfd42540b234c3e3e8cdba305a0cce5943dfc6a4cb38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5862fc1fd6f40222cdca64a311968bdc6
SHA13ef227b6f02aa47c87c9a9b45eac7f812536280b
SHA256a718a71728b02e4b5b54b5d03bf89559a82ef6695f0f944992a3546aef9c0bdd
SHA5125702fd973839ace18793710e551898030da00098779d46226fe639da2f347f73f2112fac507797a2a4abe16c965ab25eff5fce0b164b172846db8fe330ccc323
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58546d84e549e2b8598ff78eedd80fb9b
SHA14e7abe180864cceed4eb8cb79cc4b4999ed5c327
SHA256e086471f28c4100ddab7ee69e2a1c22109a77b44b339163d66608ec1f6aaaae2
SHA512a02850be3fe98fb2d8235bd324613b2eaec2a1af10f4e3071110dc124a0eeedc037898f3a4bc37d0fda93e29e1f611eeb92db2cea6f2920e263fb1bf9f82d2d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55fe08acc221542e24e3bcaaa75e2ffc7
SHA1bfcbc82958cc71b18dbe72189ed860c336656413
SHA2569407014f05e9ee424bd61ff3b06e66b1d8ecc8804943dcb1f92829e3a1cc78fe
SHA51208ce2d1c4d2b9f2c5903206409eed2ffb73e4b3db277b97cc51853fae6b492b7552f53e78e86d125ece686ceb407a60fb2c7a786147fdcdad564664e58b93868
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f10326ad1ac7a925e3830f730a61808
SHA14560355eddbdbe201922dd5c89348e430d3c1af4
SHA2567d6ab6f984270b93156f5116c9d8aa637b87e3c3652d5959f2c5137794167638
SHA5129d2fea0dbbcee30fe264896907a9628107a2cb418cd97db15803f212c0ce8e77c83f4989dd5367aedc4012e4d1f7063bc4fd9e9dde648853692e7c353f369f81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8921ca021314f46fc514cd895679938
SHA13b1f6381aac86e8fd8e611c21ae314f4149e9204
SHA2568227fc06a5be8584d3f82489ba73a6b0e2aa48bdf8baf66e0b27229cbc81f3d8
SHA51262360e6f173eedcf5d633b033f72fba544fd37e21b5b3d47a5ce75cac9a2826919e18a3316356d500a78a94db601b10186b8bdc0301d5706fa17702d208ceecf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c9523f7c741dc86bcaca137c177e47b
SHA15cfb95bd3dffaf665a17cc712542924efce899f1
SHA2560f109381f4af3248784cd6aaa4fa89242d179927f08a1deab05089cc8a28ae64
SHA512f8fad99db70e131b7d8bbd94a9ea08dbc92da93b9efcccdbdf182e15a06ce4e0e9fd1818e8911db37420dad842af36d07c7d8592eaf9fe4da7133f23a77e43ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c51095ea7d0050ad7e691f073d169ae3
SHA1e859375921b504336c4b9c670f7014047ccb925c
SHA256907fc5e8d9d7f6f5b44a4d10920ef87ecd76d2591d68573e8af7d197a4cf8959
SHA51239f536ac9f4c956762b7ca06df777767e203dc017ec7a85e2c0d058c1e862e7f1d0d8beba35388345b10cfafac642465831426f09fe973cee35e3c93ef506a8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b72560d176e557381ceefc53a49bdf3e
SHA1f3e0f51cdfc1b684d5f3e8a583a30bfe11d731b2
SHA256ede5ac58f01331d9daba762c1b39503458ff6ab06750d4c3c249897174ca6aab
SHA5128466399c6864aace0952c086df0b6cf7d65df29330a0eac6de255bf1528091a82ae8b268e2f85fc84ed6c63c75df1f5e59b6e164c6d263c70d45e49f1d44ef22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e761ad6a83bc0f85ab3e8a381c839264
SHA116a8161bccefd16e082890a244b6f6c61805b29b
SHA2567e89a2bc56c1ae29c4541e91195f90dfc64865d70793e87207f14068026c3289
SHA51228102d4d13f0699f0e8c9b8e9aceb4651272a58778220b0746e540d8f9819f5b3a69190b9f954f1a173ad218b92a5da6f58d53fcb34369148eb025aea08faf11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b148b55fed75d7e52f34142d2b9946c
SHA16c362a00246d82bd7cb3ee89a4609ef5379d8137
SHA256dc97c251353534a1a4dc1b4c207b388a96a85c95e831cba40bb756ad7ca094e8
SHA5125242be34a936422110b451369958053f4c90427486d4eb02399e2237a2200bb5addb2c3f09922388718e89bd00bbb22447c43e2c43ef330c4db459e486a40360
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5592fbbed4f30288ff4535ec9bdb42bf2
SHA1af2d606f0f0d17e41dc2b0baaca2b217aaf68cce
SHA2562b17f4ea0f8667e26d35596d12f60f71a275209aad0740f66a46873aac9b460a
SHA512d8c49f529c12c555526090a19292b32a7ae05c7e9d6ae1e66876cf817aa3f2593258de43797f3bb01dd9e71d931d75742018174bf75cd2dbe069c79bca790306
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b