Analysis
-
max time kernel
117s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/04/2024, 11:35
Static task
static1
Behavioral task
behavioral1
Sample
e2736b77c9494202e9fb1cbe5381c52c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e2736b77c9494202e9fb1cbe5381c52c_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
e2736b77c9494202e9fb1cbe5381c52c_JaffaCakes118.html
-
Size
12KB
-
MD5
e2736b77c9494202e9fb1cbe5381c52c
-
SHA1
a531fefa678abe9585e2a647eddbc1811b072d20
-
SHA256
f11666522f2ab6ac1a98064d4ad4183b8fd6760fc54749a92e926ddc4ccfee26
-
SHA512
2e403fe1e7b62fa3228a34e9f760a17a0396059658fa4fed4cebe2368ed8397441f6ca8666265b51c3a4a21571f5e62931d77227e0c2e926fd8f62de00390efd
-
SSDEEP
384:xy1R1QREDBeVliOVPpFvU2ee7Io48aXhRKY35nCPRrMO77OM0TCtxYLuZ4mXYHbR:xy1R1DeVUO17cz+Io4SV77Onh
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C9BB4381-F409-11EE-A692-6A83D32C515E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 608a5a9f1688da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000f5a2dad97e19826f102fbe5610accf9d487ffcbfbaafa333c6b48af45c8b6260000000000e800000000200002000000075c16697f439df28716767c7d62c3fdaca35d84b7587f523224d294243323d3b9000000013a84563ab526e219c9075ff55da333d1d22d5d2188472d982906a420a0ed94cfaddc4c4044837987d26405d6e368bd4572ef554b8bda10186531381c50b8bf1a7dd1f3e9424eac50d43759e6d719ba2d0c1ad9805afb3dfb4613d2cb913c17872ed21b499a2c4a7a750bc74438faf29b64390a09c8bb804fd5d3af7f2b85586910b814398f8b91be72611770ff3089b4000000006c68ad076953ce1760d4c7ea025644bfe5476f4b587120f90afded5d84583e990a91b4d00ea66a24584102eb035030f41157b2deecb6967fb002b3d31a48a92 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000e457bafafe51693a56463d869595b86c9bd3b992ecabfcef7b33abab8291b10f000000000e8000000002000020000000b866c56d40dd6d3aefc094defa1d213702fd8f5a5fc978246b1389d1ea8922872000000038f86d5adf189a7b70c518e601c334a576a08a90a38594fbcad9758feb5283b9400000005bdc13b10f930afbbe963dd75320d57e238fa1377203188559797b641c5d502fa06944a79e65eb185436f0f8a722c1863d0ce5dd87d6d04ed4f1ffcb890be87e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418565207" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2120 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2120 iexplore.exe 2120 iexplore.exe 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2516 2120 iexplore.exe 28 PID 2120 wrote to memory of 2516 2120 iexplore.exe 28 PID 2120 wrote to memory of 2516 2120 iexplore.exe 28 PID 2120 wrote to memory of 2516 2120 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e2736b77c9494202e9fb1cbe5381c52c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2516
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5251344ce517f367e4e08bf97b6e0ab73
SHA1ed7c98ae3c9f4a9cdf8298b52f87dc9ef1d9d895
SHA256d109ee4bcd7a4e4629d9478a0263babab333f52c96271a9f1b4cea8dcf82e306
SHA512d44418ae38f183d598ac75127156d5e506c547ed9476a846a3da3a8bdb3bb6ec34854057834dd61f9da79d7773a65a5a6ce856a327232ac0f8777cf6a748d11b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581a5108d6512563d59fabeeb33371d80
SHA1ad992cb8ffe413cae9fdd5500a5b7bac4f1cfcb2
SHA25646fc9b86d6c311b27f70ca98ba9411dadd8f6266895f3dd79792813fba1d6607
SHA51232963eed7b7710b9c38d321d2bb24c8a3c5a50a76945cc560b30769a2b4a9f20306290910d211a74705a8b6b875f48ef6f86c9c1d3e0e7f2db533727fc2db120
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ebf1c6df6ea902bf3559d8dde2bd58ec
SHA1e54746f9d7d559b6f8792560ef24ab152a644621
SHA256569e52f5af1a23700a0083e9bfe9054a297393610185b3ac504e9fba529aec8c
SHA512ed21e339caadb33a994822f6b1cd9cdd63c3e1d95b4cbb05902d86705f5549e89262e3165819b1c432eb7aa21ef95418068e93b95a246736cc8dc9e74a18c5d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533ea07aab35ee419d2f04c7f11e92b9e
SHA12e6cb7cacac9e18df8f55bf66cbc214d3955bd82
SHA25677e38b24a059554c7885652910088d3d3daca9faca7904aeca671f1c498e41de
SHA51215a35d0adc5481f9fcf9bcb503a4d1d082296ac82e5a83675349e813e05bb2dc8f182e72fd039bae0282a142e5e812be63edc63023e23b209e9a993db3e1c1fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a33ebd1e298521a4148d040ddd6503c4
SHA1c0e33ffcc508a4ef05a67d50bbcf9ad3f3bf1579
SHA256f777844a46164ab0c94e95b607783cd351af0eae0a0c5be808f576f062f87381
SHA5123c26547c82f631c405f632ed58ed4aadc52fb9c2b7fe52ebeabc8c1c70d989b2cf9d56fb9f5b352fd12e0d321632724a14e1b39c32a0d48e2553110414a39a6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa24c169eaf0a3ab49b825b171b64cb8
SHA13a56a9a9a9222e7b89902a07d7b64ea849c7f70f
SHA2563a5e0379fa97f3b9793a87f2091776e02f0c9e3120e95a3c73242780a6ddfccb
SHA5128d2f02221fce82ff286e8059b784e75283d77dded6c11bdb4b12fb337d9ee2a22891e9637d00257794b620df270fa4c5961e6038533f6ae17a15d6177cfbf94b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f47723a454932e0eac975f2a777e0289
SHA1bff49b402c7b505d229a5f80e67f4682ee15aa8d
SHA2563b68b59af977b24697b87dee95a6fcce7f3d42f31e5be865fc4204d236bcb906
SHA512275d1e5cde25cd593a7f59da48d6109984c71416fb03613c866e1739eaa34edc13ad1d1779c527a21b3020eacbc1f2bd24796e5855f067999391d1a4020a8c24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd255527a07768cfd30275e13b6a9a93
SHA13aa5abf68413699ef05bc62eb4bbc99221226fbd
SHA25608a730e715cd74fda66cb3ec658f0d59c1c6cd27ac53fe919c390cb5629f253e
SHA51262ae6d93ab5a3304ce64c71eb98acc42664f277712e3b7ef5061cf1351a3d188645d26db22c7bb755efbec1907f0eb50dc2b0ae5e0cadbfda3317248c29b470d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4377505a5332067b84bc195105ac0c2
SHA1eca462e7ce04a924d89483c43345d2c3e5204ab4
SHA256cd4d98d982d0034ff5121d6b52d07c809281dbee945e2d3d3361e2d077625bac
SHA5128215b29bc771080b0dcb8669936c605ac03b0439e958a90b3e28dca4222b74142c188ecc965f41f300ebf2ad21ad0fd696376a1952d3672adbfb698a1c9f98ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5178cf259dda8b72298c6423fa0affe99
SHA1db6991c4d61620b3e9f48fabf54143e8eb988938
SHA2564e453233ddee8f5eb6f5940badad138921f541865bffd476e88ecf826759088e
SHA512a9181e2fd36137e3c73c8e53c77dca2cdd9b26171926e9c9753e0f2d5ae6bb8c5386ec6767be8c2f01f0e4430bf9f15afd769b4942a5fcbdcc9a46918d3df9c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5628eefda80d8cf51213d741067501b73
SHA1f4eb7a1ef490f0f0d9dfd89719bc173a5386afdd
SHA256d0466833b755e26e934f42dba9d0f67ca3528592ada2f54793ebd331ecb42456
SHA512b8bce1db1d4ed9b0b93bf33888c7a09fe7a57726bcf5baf09a0a37a4b5397cd3a8ee89fa931f62ceb8d3a556f2ebc710f0512387c866da24ae21ac43e1db4b1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d7bfc1a5939ea506a6a40f0b4f769e9
SHA14953ba6aea867b2f997af5d29ecf6ebd8fef0a70
SHA2563903433a3bfaff840892e592c007335ceeaec7a02b31861ec5649850ff825146
SHA512a4d8a5d2c82cee9d745e6422c1dce5005a4e1dd3b277f8e668bd78c4e6b5e1d4c375d5c23edf53e5a0596158bb8d2a5522f95eb16daa7f8137512fce9afef943
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c49182be3352c50d21f3a97b939f777c
SHA16f6fd04dbde582788cecb46e4d745a69d6e4da4e
SHA256881c5e4740efd8529e32d743e68d115eae5c73d819e25bdb6ac6aaaa3090c5de
SHA5120020777fdaf69f62b1532dfc8f2d09e7ce23a92219f34343b006fb9d0ab7ed2b914762da380713a62c4dec5500e6212b8edfb197417ad728d9334740999503f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3ba9b25118ea80a91021f4fb59ac6f5
SHA1224fb7d50689e6f36bf7c57fc34a79a8112547a0
SHA2566144d42cef6d98c44b73a7dd7ce43df0c0d77c120341277ab3c2955c25eabd5d
SHA512e56764213c89ed14a5523e02432551ebbcd124f89f659a7eff4508bdbf96b6623d203bcfda83d01d80d7f7bd1995137fdde90fd5fa79b18a7828fb1e8e08d5d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2debdfb8b323f040b49211e8ee5eb22
SHA18a7adcf916d969fc1c44400bbfc534cc7a3f38ec
SHA2568971e9a83fea454746862a20dd0f98d310c4ee4f99318b73476a91a8814d68bc
SHA5126e6a7ec0a54830b80878c042b2bd58cde51e435f381d86ee36eaa4df053371ea2fe87c1f50721ab7454297ff1b60776e5d7a3a8768194fafe8fa85ce91ce7207
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1bec3aca6ee84b6593dac4d1f3f6ea4
SHA1e78b9055f56c495c1c624f9d357b9d92ef6be86c
SHA2569ac18f3aadbd824646da896bd4a6b289978a1bf692c26f12b9c6e729bac8f553
SHA5125a66f8630a7ac115c1441c0bc03918b23386ce484b95cb711f6c49ab2748dc7d0476724e7c4e23128e10333dfd4bc3fb27337e7f0d3965b2c24ec7400533d663
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba73aa8a9054acd2f2cc9946170a5653
SHA1312d327e6017ae7acb1b9c0bf2304e8ff3ac9329
SHA2569b29ecd10bfb0d1574d1e517eeacac8fd88eb2d2c023471a0e1dff152424c2de
SHA512f757906ea9d939bdcc0f7db7f54648ad4a99f5b63b26ffc66cbc31daf23b3ee74c000d114df79b9172211547f10c15c1299074460828fc6eb39559a853ddad01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500cddb38b1b0fd5c2ac5b9a61570cddb
SHA127119847df86ea7d4e230d3b6a5e7179d68ff1ba
SHA25615f5b5e60b8632b2232ef6e28f0b17a6fd6f3d5cd245544a9069158dcb3ea9c9
SHA5129ad0e97bd83188bb494009d16b367a39947d0164552fbebd69eda231a73e9fddf57c9e16c6e522a2f9f5939c48d18c27c084f4b9b6391009d2eada3ec6e0ebf1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a