Analysis
-
max time kernel
136s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/04/2024, 13:21
Static task
static1
Behavioral task
behavioral1
Sample
e2a23641e9a953bc8cd233dccefe3691_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e2a23641e9a953bc8cd233dccefe3691_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
e2a23641e9a953bc8cd233dccefe3691_JaffaCakes118.html
-
Size
15KB
-
MD5
e2a23641e9a953bc8cd233dccefe3691
-
SHA1
3d49cbddadb5b4e082bf9c879896760c77ccd31d
-
SHA256
58abda66001bff19da41d9596f6d9346ce21da29f7423d853d514926143f6d97
-
SHA512
156bfcdab7b5cf31df6f85caf8bae193500dff027555ed1172ebed58421bf35e77e18cbbdba200b02261f9cc72313830c22bba3f80226f0850b806c32a040d5c
-
SSDEEP
384:SoVP45sVqfmsfduyEZ6IWzZZw0UhqmpYGAY:Sd2YRdY6UrxpRAY
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A4A04F51-F418-11EE-8718-6A55B5C6A64E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000be6c19858587b15d2f39ef52e88e9a1c15d941ea41bdceed31e0a6658791655d000000000e8000000002000020000000385f3498579d73474466c824dbc0068592ec52f25c535ddfd38b616832e8e8f290000000004fed15e0a0ce03c28252a6118f7d75e851f837ad33f278ef4573196fb450983b1e50f804eee8ccb72321f13e70298dd90d045b5325cdbc9767eb4c9c689359724be76eadce9e9b8eb9fd6f21fcffaa9d77ebe50dd94156971e9b772dbea2530ea05d731211fc3d83af786ad69b505ba2110c07f8f68c9de139d1277c33be9861356966868d0bf7df54d746565b81554000000080d257d89fed7fe2d8cc4f058888c425e077c3278f313e38d6724bb2d7912db327c305bcc388e1b9219ba269388b6f7bc46626d78fd6c3a0f7f0e6e412697493 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0af167c2588da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418571585" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f70000000002000000000010660000000100002000000030f53fa189a62957abccb9ec69fff637574483f11282325cd3a3197a1d5bedbc000000000e8000000002000020000000c1f3aa06a066af25f8282309d1a50d2bc2472743aeade16741e07202b532291f200000009431e94adad5ee88a16f03e94ed42468d84baee86869d3c30e4868d99b9a9b464000000008962fe03c004b08be62c4023c29049df683063f7fa91ec224887d82655cd875848be144e5fe5136ee5003798d1b46e6a2095ae49f7fa39cbb9768359dd888c1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2432 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2432 iexplore.exe 2432 iexplore.exe 2960 IEXPLORE.EXE 2960 IEXPLORE.EXE 2960 IEXPLORE.EXE 2960 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2432 wrote to memory of 2960 2432 iexplore.exe 28 PID 2432 wrote to memory of 2960 2432 iexplore.exe 28 PID 2432 wrote to memory of 2960 2432 iexplore.exe 28 PID 2432 wrote to memory of 2960 2432 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e2a23641e9a953bc8cd233dccefe3691_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2960
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2c3877c205e448eef72cf99e8a3364b
SHA18083ff161d0a5a88e8fe299d868191e346f592e1
SHA256d0d0faf10c4bbcd78c54ecd83f366f7283b9be8381e3fe23c11be6d74a0c5255
SHA512d4b0fc342b61aa7fffc734ed67eee2c4690f699edff56aaae54e1e2adb08222db271146cf95afedb0fa502569646629ee78e724174b43f04b743ec3f792bf877
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55de24b2c38129f0145cb6beb9261891c
SHA175e65b64f35bc697b04905f9de5daf4dee3558f5
SHA256971872ffd050bbeb0beffc4314fd3bdb9603109ff1d6146a8857ddf744e1f5ea
SHA512a1112b4bdf1dd78d7003d3bb00fad9899f062a6ed9144bc18ea5f2a535225c290982deb563426d623c6a65ac27bfab8a34fdf90753693fb44efdd1af96913ca5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efc747576bf68de3d8874776da737b7e
SHA105d2018f564ef1898f041a287477f15d3847a44d
SHA2561a980ad52dee67077a8b14d787d4b7b53270e5f0ad9e8aad8309fb4cb7a9b1f7
SHA512fe66cb80a59b9c17ce9546df56c5cab4d129bedfffd5c0017d78404f88e0107f34b8cb1994b226c4f646ec9d9a74e9b5f72136565d93f245224f0ecf788c9233
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520a680901b1c66f6b4128aa2f5b8956c
SHA1c74ebae6bc0be58660399784c1c317484da2ec67
SHA25652e61b6a45fcfc7c0ab568207ac033d10ba932e04465aee1546269e7c95b9f2f
SHA5122c0ce5260904b5ae5bf8763b52fdd80ee5e22001ee09ca6ed5cade0f8da367e68d3e115e2795cec706ccb761d6db5c5159cd9118d42e4e48ed3b68989c30244a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df2b2eb4d6a3bcfcfa5465d57b5cfa6d
SHA11e03053f678ed1921ae498509075f32a80cae618
SHA256d1a0a78d6edfefb42de1819cfa6251e6d1b8541799403a5f2e8d70450bd9f8d3
SHA512e2b96f2ca64ee9fbae6b190abf97de9ea6417f07cdde16a8663e6b8364ee3a70c192d1abbc343cd7df368653aac51649c1e4e9f4599b97e6e9b4851a6ebf50b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bfa1cbfc2951f85815959d0fddb5b983
SHA15a9fe73938a17dc07c978e4605f3e14953ab13da
SHA25697a8bd283ca2ea55c571a58397667a4d45ef013641f0575296bac256f5c21fe4
SHA51222d628fe785205242cb0adf661f5f8a8e2078ba63502796a9bd4dbd17e7d9a90a2f0646bc98055153e132122e162c3e4d573255b3e250c2d3b951fa4d22189c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc157faefe9c7dbe9503045f5494dfc8
SHA1803a1188a5c849f3d870ce433eadc158a1ac81b8
SHA25696fe15340919d0e438cd30d7ec78fba4f8f27769768430cb2e96a09f3eb5b485
SHA51244aaa386c15ac6e79a8308f3067e22e495c286e2b72368aa7176f5997d3497e38f49a8dd463ea25ecf8966b368adaca8cf3422028b1aa734c0f54198ec322da8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe6c7a6c574d2eb434e5b27c10f5024a
SHA1263ff0216750c755d05319cf34f5ea69d6093886
SHA256b00385b33a13ec64544322e7a784a2822bd378794778767fb1d1942f5ac73d3c
SHA512a042394dcc4c3c9c0352af0b7034630db0e2dd71153cc7ce4b106709cc4fd03b49d95d9222c23ec4409616f9b4bd21304ff75bc132843713ed658d92dad827ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0551581e37d7cae71b84c13de61bc74
SHA16ac94812e7e709dafe5ab625de1aab3d9d1b2033
SHA2567afcbf2b44ddc86108da50939d1fd6d70144355e8c35fd8c77784a7e2a3385f1
SHA512e5338f8ccb30aaa9257b529edcbd21301c1703d1c38d325b38124e4d1648536d2f154bd26fb692b59158ef40812dbbd6ea8c07a32ee4a7e94f51754da2db4fd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5670d844b98844615cdbdde43f1d216b8
SHA1a931d21e841d231cdec4df92091269c06143e893
SHA256b428b4051f77264a5f3b2e2a617658401659c8f074c567fded250716f7d979c9
SHA512975f7dc06214146e7841af38c53b43e78fbaa229e64c0ef79f438e867351b7362c5c75f4149406d728e44783085946ea519b9e0bab49c9aa665819649bc6e16d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5870e947fa07f70a4b8cc1ea69e905b4d
SHA11d9f578820ff2ea66997c06306ac964a2250446e
SHA256a73b790e054b0669bb6ffa719e3aaaac24b246fb02e3b5682efe2ed2003c24eb
SHA5126253b766da3b391d45772cebf210c9870e6bc1b8e7c9eecde2c8a8170d4bf38eab40fa20ebdae394432eaeec0d7ec78dd84ff1dc7b7b01d111c3c008c2ac5b58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c82c639fb6b25c73103bd37295062501
SHA10c005ebc9c1b00888c1882a9e85c64f5a9dc2369
SHA256a6d8b732425ffd85d0b9dadb075c3bc5dc89d20d49a24b899cf66bc628925045
SHA512250abcd806a4d74afa1af8a6db3e894eda5a8f2e17c7e07f39c46391ad56f72cbc886ddd9eb65f15abf61f6911bf18b161adece00059f2e11ad7ce63cf0b1a6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565039d26bab07104b307c4b04c818008
SHA151aaba50aaf3669b179d2f361a0828fce6e19f92
SHA256c5699199ba1992e6d284a3bb0a45c38a121e84c82658c098b67874417a0c1602
SHA512059bdd49e2086b5c363a82dd67f3e626bd0a6125b3b99c468b66d3c91d054c0d02dc606dbf140dc60dad5ebdf93513b2c814bdeaff8e70d87379f8d029716543
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55be4426a33244da32357f5ef73419707
SHA140224ee6cea7e679e6504222207f0c50e6c94c1a
SHA25639b719920573f2f2cfecbcd258ee64eaf4d1128ffeb8604f0bd1aee94ab45bb0
SHA5126a7fe68fbdf2a2d1ac519a4212ebb81c99798d999159b506124a3d4b387fe717942eaf987452feb7357af8d5fca10f712514994f4ee82d78176eefda4a6ab59f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529e11dc1fa4ad57bcde4711ceb3039ba
SHA17ecd984af8eb2a07d57faef673e959ee0b24c968
SHA256baffb0f412996f70d9f6dc00693eed49ddd64807e7b9a51358ae9a8e9c128dce
SHA512e97ad3e7aca12058fc19a53dc1da54397932716468a094fa1a4c65749c0d258bdc04f6da52bff33e12d9355765009e91b31938305d448f607a346d4aaa64fd7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569c576f159b6a438412a1a0ef7ae1b2b
SHA1c9808b0baf730be74a0b33952eb3be379b5613ae
SHA25696e446b75fe5a4fae22f4ee1c46bbd3ec015640bdb24dfe75d6304ba0b977337
SHA512ed370a6c086a44124f1857c35622ca6b0bfa73debb0f46273c83dc3eb98772fb7548ac411933386937ed11fd9f5c39bca4ef9286f9f3a35512c26d9ddad98036
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e87654ecc8c4f6ed2f866352e4a08b4c
SHA18b0256224212e0da85d87dec563fcdf7c391577c
SHA25645864b93e2b11139222916e88f115c68e309ecb7633ae13b7e1da87afbff26d3
SHA5129bb5af856b9ff3e9295c06f3c683d89c3d5e787d20f907552b2d9c230d95a6d7bcad8b3a4df1e555149db7330ca7d30380375c08d502d8f88c969ec808c9a3fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d50695ee67e3d2e67e0eb91c92bed5bf
SHA13b37fd6166959a7a89a6b6e70d2701f2855f53df
SHA2564e4db8de58449277b89b7ffbf9258a67a94ac5712acbcf584bcb2cd7ef294ca7
SHA51200b7f4fd224fd51d1d66bd5056b1158a5853cf2f4ea0510b41ad04dfc6bb0cb3b093c887971449e6768e9b4073603f573576faeec715517f41bc3e4384b00742
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a