Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
05-06-2024 09:28
Static task
static1
Behavioral task
behavioral1
Sample
97bf050828e04a928ac84ff3d2b8772d_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
97bf050828e04a928ac84ff3d2b8772d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
97bf050828e04a928ac84ff3d2b8772d_JaffaCakes118.html
-
Size
28KB
-
MD5
97bf050828e04a928ac84ff3d2b8772d
-
SHA1
4f0152298eed7ff1f2e5340f7e2230e29b596db4
-
SHA256
6c3f453da44e19d09064debcd11ca72e1a4fd19dbc23842067dfe68c5da94282
-
SHA512
067fdc6bcf384eeeed3b9e6f27545fd9eee075195b46b9cc2a5f8d9813672f537fa95d62bf955c967bd8e1404096329871daea1c51061d6ba431e3c655c6b4bb
-
SSDEEP
768:lhppSSNzE+PioioZj3GZdXGKPP5CsCl8KxUv55nc8zreGk7AscoCAo:lhppSuz3PioioZj3GZdXGKn5LClzxUvB
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0053E581-231E-11EF-A1DE-66A5A0AB388F} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423741590" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000001b85f988ed5f67527d6707a7624f6fceb84be3028292cb77ce90517237c7bad5000000000e80000000020000200000005e5237bc2881a02b2a81f6fd5ccb63f827dceb39fa156bcb24cfecbdb30c857c900000003c3b4e6595b40955958e19a098a0ed0a093437515b257b9c51352c2026261582a4806f1ac8ffb399d6174dd8fe1064baeaf2f36173977c79a5fe8206c69d507852af8dc6e8a45db8e8b800f6153ad1e1d911298b24ea4354645b25b9a1dab0b33bf254c43877e83250272745888b8052388532786411a0bd3046f95c9e9d849b0c19ef4421e4e36e938bc1c22b19d9f6400000000941fd910c1aa35a0b93ac32f7733c692129303d4a88c574bcf28a69c482484d3f3a501ca0b00b053ce18815d4fb544c9bf7cebb9345d48801e59657201a5278 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000ef91c56305b2ba65d9d0d2dc8b20b6bc630c936e75de64403e69755a0b82280b000000000e8000000002000020000000fff3310fbe7066f810b59f03b169be15341daa8f2ccec11b900583faadc5065120000000e77729df2aef59095dd509a741f55e296a111d5551f16301a11314e4f48def4b4000000004552ec81314bebea58c4163702075368367613e188e78827fcca983c771bf93e529c26a018684cec950bed01493595706da5b321e4d20b212f2e24c94924306 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70998ed62ab7da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1708 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1708 iexplore.exe 1708 iexplore.exe 2052 IEXPLORE.EXE 2052 IEXPLORE.EXE 2052 IEXPLORE.EXE 2052 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1708 wrote to memory of 2052 1708 iexplore.exe 28 PID 1708 wrote to memory of 2052 1708 iexplore.exe 28 PID 1708 wrote to memory of 2052 1708 iexplore.exe 28 PID 1708 wrote to memory of 2052 1708 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\97bf050828e04a928ac84ff3d2b8772d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7d07dddddf0f18441ef57aeb54618c1
SHA1a6f0792366417e8c635787874976b506557de5e8
SHA2567183e151e9948be91feec339b012c729823cad82d74e358f4ffbe6b9311778ac
SHA512fb5a74f3852b323cfd00b8231212d095bf3c2adb2bfeccf9d9271220344d970e4d8d3b33bed08c61f24ad972e946f5da94460759e2cba1d51e849a5d2e5ddfb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6a10b783103a39b5fad6602533898b8
SHA1b9efd8b2871d2b525540425c56ac0906d5e75618
SHA2569db1f81e9be081aaeba99bf3e7d32beaadcd9492ca7fb34951e4aa715a258f34
SHA5128acd1dc1e20604590ded17c2ccb794b40b406f6b4e70af62c694260ce5acdc59665e68f5eaaf7073c8c815f6eaee47eafeb3efeaa2f945147c732b1340460f48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592966aa47c8f1535017d7650a4cb6fa5
SHA17ae6afe7c5225091f0f0379331acaa05b5d3534d
SHA256dd7dd0c38c773ab6a74adf69dcbc4758753590e4073c2445e75250762b4a8be9
SHA51200d2a2ab721e527c5b715d7c83343a2fbf33f66c94e24d4ef16327d21fc46a3754e009e90cba90f335b20d4cb4d9f5cbf9e7080f752b8382d7fc5c6ec845d5a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2b903bfb5289769dc423b8ffa5fd213
SHA1811846e4476c121fee9a578bb6c5517290b44bdf
SHA2566a9980d5d5f7815c89d408a7ea129362db330fbdf1ed39a232b36493aabec03f
SHA512bd98601d4c162465e53bd67b8512dee86bf552bd5cfb21d4c62d70b95418c9d708fbe1e2389a63b4ada06f1e79950d292126dea73bc356ea55cacd63dd143dda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54966162eb1d21534f03bff800a919d4d
SHA10d48f2cfaa2c3a44156ca7b61d4c696e34e4136e
SHA2561e1d23e5f0458dd2330f4efea8c6865be19e9fa634cad5a159292def224a4535
SHA512e0426e9fde40a99106a83d7daedcd8f197037c3af1690f01f4ab9b41ff5f665d67ff9530b676d58b8b4945057dce1b1761441c8c44590e1c2e2558c7043d4d90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c82f2077861529d44d7e5111ab97a827
SHA1038fc441606c4139f6b8dda6768f9c1793c568a3
SHA2563e51f1ecbd24ab5d72fc74ba4ea3aa3b4228d2a802c96f2594012a2a495aaeb4
SHA5122023cbb2bca403b9fb92e844f9f1f94799346e85a983764cf5d3810be7ee35e8a91eef8f3d07e5a95f960e35ab429dca144b87ac4f1e1b3731d10e7b87f76aff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed978756ee678ffc431defd430466a8a
SHA1b84d59aa3834e48da16a4d3b46326cad6f0d74cd
SHA256d906e192d2c417c13e4b75b2243b164f7a064d76f4f532d8c99308d471b96d72
SHA512f3a5aac000f32db146c312b3afbdf525bcd04fb275d478c339b28077e75e6062b9a310112e613cd9c7b6b8c212b03d565322bc58ab5ad257c0b204bba6fab18f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad5b3d40779cf35de18007a1bbd34a75
SHA1018794740d46d69800997b7121f32d4e97f7945a
SHA256e14fa730f176cbd351bf62de849c7b8957556df090fb7ec6da9368cf756949c7
SHA51234076ee016fb8ab5987ef03506d8fc9fb10cdd6d1c35ed1494ed5a06f4d7756fae77f3b6f3b842bde42018c377eb0d4dc971ac1fbd13275e2fe3c723af8bc427
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5533760a403919eb8ef497c82e7389c34
SHA15435fc43265b353701d667f9f848459a4700035f
SHA2568f100b6160b80a824c98e42185c6e1d135b4983786f259e34ad106ede5469624
SHA51272016346a072071d3d679f423d04feef401e4ca1f3c6041aaa68679f588ef88ab7480d34a2aa58e586695ea58639d62ada28131f6992ff18678df4b9b8f5fdd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d33b4139fd9ae07cccff0779babe2807
SHA19292eaebe329a31046715e5652706e368e638912
SHA256018558ff5a01e972a60bebd496f8f342f2be10e8209bb4449357df5c77caaa3c
SHA51207f51084613fbcc9861942fcb4cc6b2dffbdd15adcf4a67655a6140ccea9ae505c71e2ab92aff0923890364e24c6ca9a53cfad57fdbdffe107642eb8d2ee47e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540d76b319263883edbf9d575dccd46cd
SHA1a495b0df9e0019ed8be0cb8f7afbc46d177711fb
SHA256f69325770dd5121b4f39449baf496c4d5929f514df27c89fdca16a44b73b8d75
SHA512c870bf49aa66af7c5e0176202f3d0fb1b3eb5a466cf2caf57266d308f2ce3e112e366063d774c34102d721791dbfd36696bf10700f57ec9a4074b54c9882d9ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520121dfb1214699d9f7b637602d96b80
SHA109d292385c3fcf968c841498d5010a3d944dff56
SHA25645575f13cfd786df03db4a1d82baa06fdd2feaa6e6a09d554e46dbf1569e572c
SHA51279a138c34a85c592a78bf4b6dc88540dfc9878168acb815ed32c7005ebc1c16750f5a3bfe105c4c6efb67bb5e8bb2a4354a0ef0c6b25c3ef5af4b9af7de38afb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b98e90bf403b9cc761c84d2a2b6c929
SHA171d7dc03e3ecb86fd6f7fd5887f91337d2f02880
SHA256486e663f77e969ff9386e1111f61fd7fa3320ebc35330ee55d0ced45dea115ac
SHA5124251049c2425a6963671e6c84c95f66ffd74ff41c324d4af80168bc5e79bf51005e1bac909cd3e3bb31b7c97384a4e3f392b428e670b41b7fc6aaab586045a93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cac000bb05c5b2e16c95e69c3d4a3528
SHA14403cf8461221148506a3e9e6b88f8fce569faa4
SHA256dfc07ac62263caaacbf8ebaa17cd9b9974f664e667776491f454f6f1469b6e1e
SHA512f7de7d23dffb44b8e00c87ab61eeed465fcdc16731af14e77934faf017c0c6ec34a851bb9d3de286f215af994350ebcaaa5906c7f7326e8154d298fc272e6f77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576cc0ecdcac87f390231013ddb9ecb20
SHA1cd9c93c8e1a85c3f177ea0c1e3e9aaf1dbe5e66d
SHA2560b5587bd14bbc21a68eb32a8ffb44394b7d5cfc17ff601df5949833ae1f9bfb9
SHA5124dd2c7fc24c81c268ce903c13dbeca58a0a837f4dc37ac475909a354f91ed1ac5c03e133001f531e9a414f8af9e78c676f03d0a86fb5b87b124496e9e0d25fe3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50774feaf6dc954f9ede83045b3c58457
SHA1e6f6ed42ace538789dcb6f986296dc334164629f
SHA2565cdd6cde2d5eb1abd651266281a337f36eed5a1f409694163d83b04d793b199d
SHA5127e0d04db858e4008f14dce7b11418e4e5138346c938dd1b03c4bc11f3cbfad40df46992e48602171ddff0b05e773dad319329aeb8b8c2f155ca203e8ef5f3ed2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e3063af0fe19646dec5bdca95db3ea9
SHA1e1ebc4fecada146f2119a629e793a9441fda3119
SHA256f52f0b682fde3caa4a75b90bf64b5b22dc859aa051fa0eee7c13ba44db2dac70
SHA5126d1acff21139b56998764478c59a8d0415cfd0da6ddb35dae775259154c8500ab9e06e57dc227da34d6b15e88b473412f5746f23f081008840dbaae390dcf669
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504a083d7156a0c9f36992d9d4478173e
SHA119ab2c3ed46e0c4059b76de09d03b08197a06dad
SHA256b3fad1c9c6315e743890175e43a1c5384c0a89a73a4de6ceef0d60c1c9aa92f2
SHA512d5e11fef38048b8997d3e3542379949c89253935574cf6e9906f621b70cc84e4d7e00887114d867bf2c1ee6bbaeb4104d91ae07446c4ed4ec571f73acd1ba747
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b