Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 18:28
Static task
static1
Behavioral task
behavioral1
Sample
ab23a36beac3b5469e65a8ef5ae13533_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ab23a36beac3b5469e65a8ef5ae13533_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
ab23a36beac3b5469e65a8ef5ae13533_JaffaCakes118.html
-
Size
14KB
-
MD5
ab23a36beac3b5469e65a8ef5ae13533
-
SHA1
fcc3921bfdd842164510876c41edcf2df121be81
-
SHA256
866fd6153cef89dd74c28f22dcaa5ad4644ab13d25e0d5e6fc662edcef22b748
-
SHA512
ae9fa52fa127891ee8c0a37befbb706ed42839bf20823f42be3fda2b62f3d8b0c435075b0df0fc65e1ba0cb816a76d12d67dd081481e34b16ad5dbae597c82fb
-
SSDEEP
384:CyinEaQje/tWy8mFAi7zy1wI1M/2wPpilqU+FXMiiWpm:CyinE9jmqOAi7zIB1MrPpxU+FXbiW0
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424551555" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ed7b2b2deb027b4fbf1454f23eddeef500000000020000000000106600000001000020000000adae3bf6ec607584e28b549543040bb2eeac17500e3f49e2f893df46ff856327000000000e8000000002000020000000e607d4f97e8c36cea5d51d4a05a00e2c4d4dab452381339f879cfed8ed989419200000005263d704722f59354631d0c0482a0a26f22a06a19cf418609e5d6dfe3a721fcc400000007ba91d776e97f3a9c0a6016ccb00cb5e6fb411b98be7a82900d05f3fcfec1b7b7c1828838af219e320459d794f40aa9bf7b7dda939e8f2635b7ac1af4ac1044d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ed7b2b2deb027b4fbf1454f23eddeef50000000002000000000010660000000100002000000015c2e6e4a0e08f9de28abeb0455fd21b896f11f506a35a9f4b462820b1e94a99000000000e80000000020000200000003d5661bc87357d4038c7c71aa1268c727dd8ab1f99e116bdab4b6e3ff1311306900000004dc2ce88b5b8f0c814d545d8506c66558b48feb8cb65ba8c175577ac70b2dc1280d721df999012808158266ea74a1791e3edea10bd27cfecdae3eddf550ae730534529c22db599cff0dd5b071ec9204eb075d49c4275cc3ac9fa4d97a3e54a87f7177aeebc7ca40ed1d0353b3bbccb5251d77d664fcf6dd97f38109148cf72cd1ee71d5759cc6d2138c4806f9feb5cb64000000085eb187c9ee9849f618774eb12c05cafb47d6daf7a970f64788a8f704b0bc2c163bbf30c934b335578d3a7988ae5a549a8a5707958671f63791e62b67885be83 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00a75aad88beda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D87D77A1-2A7B-11EF-852B-6265250A2D3F} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2064 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2064 iexplore.exe 2064 iexplore.exe 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2064 wrote to memory of 2896 2064 iexplore.exe 28 PID 2064 wrote to memory of 2896 2064 iexplore.exe 28 PID 2064 wrote to memory of 2896 2064 iexplore.exe 28 PID 2064 wrote to memory of 2896 2064 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ab23a36beac3b5469e65a8ef5ae13533_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2064 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2896
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0fa4e124dd664943390abed0d24b714
SHA12271c65360a2cc1d0258e546fcfdac7c66a9e3a2
SHA256e4b28a4a5411d90e927b95ded70cd7f8aec4b4c19bc4d6ba6fea33dd66c53ae7
SHA51215f82010652e9a4f2ba0a109bf34f495dcd8034ee238c789aa01d5b0a8ff3cbc45fab8461ad200c6f016cbc83c88d71361dc76efbf91735457675c681e8cd782
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c0f3a73de9fefcd86cd6ff24bc8d93ac
SHA11deabb66a8bb967c46f1e3393ef6ec3aaf70867c
SHA2565ede3ec39c1e3d91c072bd124734281ddd8d3687eae000e36c2d179873dd6a1f
SHA512e2699fabb76d5bcf3dec2cc094e0fda858f16ee3cb320d094d0a2b42ef5e56d4e5b318cf363e84a11ce495ac7373bcfae45e0c43f57c3986fa46f20b6e8218b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58179c8af7d50b8e84b60bfc8efd6bf3e
SHA15c6e3a76fa42119d6098eb44bb3f3dc33d641c61
SHA2567d4396c3b6d9809f27aaac33fe9665714c48f1fb3987945758afda92b55ec704
SHA512ad49bff9628d17857c33ec8f85b9f388ad62bfa9b1ad4b3c79a7897a37873a4556fdd18a3a85e6209e43e5c89a7552c8b9ee3f8cace486c6e0f45a706c7ef332
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500a043e3604cd146d2e143a6937bb109
SHA136363b9be70e423bccd1d89d23b8f6527302ff57
SHA2564fa9a79ac2592cb2ac868a9c849550f44b3ed3c0bccc964502535ca7f3b48afb
SHA51219e5b061a098d8f2ba8b55c8046f38be891f348b782a66b2d80478e0832ca27a70edfbc8589366a0552f4c6554dd104e2028f5b2daf92f51a32fba6c5eb5e494
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1810f537741d96590e6219e0b31b850
SHA1b0d3a0e5539ef5d5284e8b1ef5a81e6c52892eae
SHA256ef20939794aed55d2d8d7f0f07f302462bc528adf9226006e3e4a979013ba253
SHA512d0a75f2b37ad593f136730599f768eba27d461358213745bfc6098cea02aef5d98fcdd5f5e5cdce965291b4790392715dba76005f259eca4f619bd5de73d375d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528e129a13ad7fce4bf24aac12bf28ae6
SHA185b6206de46be5d60f104f3005b4c9abb03d777e
SHA2568bebad1695f27031f4a456706240cc179f726cd017b5fbf27e3860ec09221faf
SHA5121189b838a985046d06c7c5e34978d6847f252fb5ec2abaa03be3acf4e5d27fc1d1a26551cc4ddd8db7b3c3e8bb8cdf2e532ebcdd73b352dfab22b48d6b9ab303
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f06e86f9162c23fa7c1a8fff7cb8103
SHA1b4060d71305e77f218c57dc0d2af4e212f94231c
SHA25699be96d8b07700a08bfceb99e823e6bb37b0fcc290a9ecf01270fb321b835c03
SHA51286bce53028a58e77c18ced9ee5f4369410d208eec259151289dd331c1d37bcf43b09ddc0ab7dd54e6ee0cd596030f398052099b9464b3e50a55e5cd54d57230d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517f82f5c483ffdf42b2d5279d6bb17f3
SHA1b6431e52c978382375af924cb5f191f1cb2ace55
SHA25651b283b2c37d94441657d8bf6035fe37e3545d4fbe318265c862d51b61e11376
SHA512841c137606609d36be9fa83c976754b83ec2a180123d1d04c9f87f737a1cce19175fbe4b31bbda8701bef8636239e4ccdc43844c5bcce9f67d34764c0dbaedfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d02b381d6ea09999ed22e7cc684e5a0
SHA12f387e44b3bf456418a89c0363b6b7ce687edeaf
SHA2564e458c5f43f687de04e09a3f7883188e437852e0c96bb399c6eb54bfebd8c28f
SHA512ba9adff25d94246bd12a976f97848e9f41673cb88c2d334a84e23d575a9f22536c7af2511b03b4ed664e10d307f75369e625535da6a72cf896e8c8f6e8e17243
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50dcbd2bed77a438ce0042ce65efdfdf5
SHA1390832249139e99c51628448a1b1fb18d41b53e8
SHA2561e9eeca266e3675a1408fd24cb9e4a4cc542f8320503398fb3b85618e0666627
SHA5129b5773d5b90335fd31ac9ae62be1db878f9f90c53042a80c8780fde4f13ee33807924ff236d0efb4e09d9736b7bcad5bab131a9f48657d155b1aefd80b034945
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc99576fbce88b10b45aafd36beced35
SHA1b5301e69b2ab132c1d297c8c6fcff2be96f57feb
SHA256e63a2ee855a6855600bc4d884d1b6f0867cdcb93629049311d2ce6f629dee955
SHA512ba21ce691007d175138abaa1e097b82d7f271f7be8d838f24467d70272048432a2dfc4c929fd39bab8daa93dbbc1f5caeedf976b8b1acaf4dc9d3b2f29444663
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d34fc0a99fdb0156da1e3ca5d8eb4cb8
SHA127a6f5f26c2fc7c05d48e24de329a9e594e5ef63
SHA256314673aff98c247a38c40ae14c3c8f0b9d7175c911ec2eb043bbff7f46ba0274
SHA512aa63ef306e8e225f001eebc5d121fdb614498aa2f4b7603dc07449da5da9098262af7c16eeee244b38ee391562b6ffad9191b5904b6081acfa3da38a3ea694d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53758de744ba16fabe8c4c1fc05cc28e8
SHA13bbdb35c328b74beb963dfcf5299235aacdc8aa0
SHA256c2fa4f0fa27b49795c4ca9896eab54feb419d7be4d845f80a3c034c80aa6ccfa
SHA5125b4aaba7db1c307cfe3100881767c15393ec230a840db88899ac8af096f9bcbf4a3fa011ae88d16be26ef58575453d9ca98fd7490e65765164e0dca39dc3cd9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa059b0034d0b7c8f71c37588f837d10
SHA167ad300716d9d3855617da420371572f6ea1a194
SHA256ddc5149af85bd7897b27650a6521e6e0c6668da74856d5dd3c4cb585fb567a15
SHA512d0cfe3b9ec075508ec132b12de29d444d39f84efdeb84bf8844eef542b3aacb3cf0cf2a80f97c1f727dbcb9e869be5a17c549419a9b22a0b9132af9f17eb451e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e9618ee88efcdab4e661f91af264d6e
SHA14c92353192765fca9275813d31501e13d836ba1f
SHA2562e7e8976243cbe652fe650065e33cba489790bb7d6fc2b7033af09bbc727461a
SHA512e887319917d166ecf8ac60db1d475b1a02adfbf696ac177de97b1e1a65af1be3a2cde585d323b98566a9feecdae85f65bdfc9d67470a16ee30c1255976124a4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d52f12c4e64c1e407b1d3cf2509a63db
SHA1b1495b43569c3444d340d687aa239ac53362814a
SHA256f082d2efd65a648855524346a05c20c26a0f9436216a0c769ca049c94186c1e3
SHA5126bb73ca6bdf97acc283f286c3911e96feaa74d17de1c52e410648155af3474ade8522b351fc7979fa56f12d9450b4e85376443296ba1dc84bc8bd0ac31c3c8b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5ce798f4bb3dc34fedcff5f346ebfaf
SHA11c1af3b6e606cd7bf6ca64218c3332771604f049
SHA256cb03e3e586cbfa3c76cb018ab680e3f4bf274c0edabf7c3200dc22a93b64dbbb
SHA512b38e1c65ec030a129d55ac5cc91bae6745b21d588cfc2b2df21537335d6047eda2a877a6715f4c1a0d082416bb94159bf3a30caeee75a1ba1363e51970b9e484
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b