Analysis
-
max time kernel
145s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
08/04/2024, 21:27
Static task
static1
Behavioral task
behavioral1
Sample
e873e5abc0dd082e8e68eea3928418fb_JaffaCakes118.html
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
e873e5abc0dd082e8e68eea3928418fb_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
e873e5abc0dd082e8e68eea3928418fb_JaffaCakes118.html
-
Size
56KB
-
MD5
e873e5abc0dd082e8e68eea3928418fb
-
SHA1
734c55192bf55089ed71fda58b0bc47a4324dc9e
-
SHA256
e1b20c2c98646f4becc29fefcca114dc770b12758161b56de89b03e847c99935
-
SHA512
651e8929a60a76e3dfada9ee5cd69a1df0a09c7266043b34c6870e77e55aced52679f6b5f45b1650e2b0bb6a99276d293a8d8e7184b11f092f8af591ea94cc7c
-
SSDEEP
768:Zcd9QZBC7mOdM1/pC5I9nC48Q0obKVi/HUGjPd:gQZBCCOd80IxCY1x/bjPd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C92F1681-F5EE-11EE-A9CD-D63DE1D22445} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40eef3a3fb89da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418773517" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b20000000002000000000010660000000100002000000004310290face79d690ebf83c2bfd0992a3fb9e92d00dd2f68dba51900bf08219000000000e8000000002000020000000de5958d775ccb4133d98949c0b68f0633d1bd408deb933f472d7c824d965afe420000000bfd9cadfa10d69eccbcfb4fa028102f8fb45d1160d5a4e5ad17720215f6cb9b5400000004e6800cc75960d248b2dc215434d1f8c805af8f2bf2139295e096b63645344a8b481e0bfa37670c0ba063573069d4630dfd278b865e0071a247bf75dd964744d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b200000000020000000000106600000001000020000000d167805d461dda13fc2e2e8f1d2647bc469cbcb36d3026e0dab7cbfd062e43eb000000000e80000000020000200000008f1db125677fae9091ab779b4e2acbd560bbed17354076774ca13837dcd152699000000036696360f701c6cc792ded8fe0904103b975b173ab5d594b1a5ce278ec327048346c5dbad4699bc06fe53822275f53701eac99bb3cd2e966501529527bf4af24f59e81026d8da6e60234d28067070779187d934dfa75160f7b3a1b1e556dd78cb531be378e44a0211fbeaa858d6052d41fe7e871f38f09af9e4e817350248080bdd66af4741028955e83eef42405377040000000994195957bd05fb18ced309dc52861de61517047c7e2d0c11c0c86c743fa25f928667d6070cd8f6b288a9c471a8c574ee15128665b8cb0b911a48ddc2fbc16a0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2124 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2124 iexplore.exe 2124 iexplore.exe 1716 IEXPLORE.EXE 1716 IEXPLORE.EXE 1716 IEXPLORE.EXE 1716 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2124 wrote to memory of 1716 2124 iexplore.exe 28 PID 2124 wrote to memory of 1716 2124 iexplore.exe 28 PID 2124 wrote to memory of 1716 2124 iexplore.exe 28 PID 2124 wrote to memory of 1716 2124 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e873e5abc0dd082e8e68eea3928418fb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1716
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD515d50f7d84883fb3ff8a7f9f64edb371
SHA1dba5dc906a05b147deffbf015be3ecf7a52aaa5d
SHA2563ea4f068beef7e3265d7ad043f606b33ff2e19bf5e204e85cabc4edd9f192e2e
SHA512936b8a454b96697198b6289a2c65e9163b51c777c2db7f61a5cf3f1c089ff70ba928cc86ae81bba35169644e79e394f09fca6ce5cf36b5483ccdd672d4450f80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5130767f49b6d205c3e2bd8ba7e6ab45c
SHA12adab9d99d03ccd63131fce9e6a04f5866ca8666
SHA256865796daec820fd2778dbd5664cf57a18c039501aefb12f6dd605452ca5bd8ee
SHA51281b23ac77bc9e1c15ea5b941091d96bf231464f41b009430fb8cf4a92f8c12cd41c082dfab709362adcefd820bf0cc0d571cc1a0f6560e6d2a2f1ee3b1beb8a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec7538744fdd7e094d8be447303d0e48
SHA1d896843a274bf1b31f0369a2e6b72c0744c0d06f
SHA256f7178bafcd338135eba1f435a1c073b40494252d974ac71f55407c92079213a8
SHA512be74fd0372cdf5235449b5a15cd19cbc2d85a0d4b74b469aab73c94b28e0a16779d74ba39dbd349278c75e0495b1289df4a88df07d6f9e0ba103ce66d019219d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8269c8cd04a2dec0412c92a9ca87ccc
SHA1002e860f22ef98a19e0975c8435d837247bcc4f9
SHA256813f3c2de3de4531ac4fff8829d7df30411d9dae83e3fa25282606efdd3151f2
SHA5123ddd59635d48ce3b900e3b5d84e055e8b739025f2403829f325c770c720462d0450c43e0283233203065faf280176ba3de5e3744b4df239537ac942e4d416dfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52323b61323bb897fb273e52d68693695
SHA1fe2442ef79a9cb3e00c873bcd71652b35e5c440e
SHA256995e71b99223863db9f823ab4e077228b78176a838f10aa23838d4d1ef12c3d1
SHA5121ddb4ff3e86696decca905a8b177f36b075213c6766a1bd22cee95057060f745c969415e4d4542cff2ced08adec13ecabfdab98892263a583edaf7192867d195
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f87517350007525a1980ff6993b0939
SHA1ecba97dfdbb8d1922b71730fce761c57583d411f
SHA2567c234b95ef1d57960057a3d76ec531a355825bcdbef510d984b53fd59ae2b479
SHA512eaa73617a873f259771fb2edc3e3baf4ee93ee5bad2de2e86e24803608da9917537e421588693455b3f841de8437992ac163e147f8f826c604c7cf005eb5eebb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525f6df8e0c05b40d8e30c8cb0959b983
SHA1a8897f0f14399595f54229677cfd23fb9899640d
SHA256a390e25e66cab30870f848e085b450c6c37bfa0c86048b112052ed1f54600fb4
SHA5126a91ed45e533a9e7105e4ea53d428f4981f79b4a99c716dbecca0554d21bd67cf6c7e55eb708c4814105034c268d2bd841f0cff5b1bf17376a19fcd189d3e7ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e64ee689c67efd2afcdb93fd312df2b
SHA13d821392f79a63bfcddd186977bf608a6fc8ccd3
SHA2564845b351f291228cfbb8eb6a72423c19696001c6c444e8a520f18fb87d9dfc76
SHA512adb9cc678d93553d61afd7fdc08f4186effaed10f8a37df2fae9aa8b2b156f05b69bf6e939ee1832c4305a984b59ebd5926514cb71dcddc060f87d8937550d58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5615d8ebfe09ada4d47605608c3c56638
SHA1fafab8f7707d3f6724ea83ce9c909cea73c27069
SHA2561c8592e7b6b4f51236c46ee9615b2f2aeb51b60f527d3050e9c654dd1d06f95d
SHA512b0e94d1e70149549256441b3d9d8ad6d67e7695b0b67cf41bb7f39203c38a726795558ea93f4021b416de4200fc5c1d5b1520d83d788fd5576ed9a3e1fa981a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5006d5b9f5a889ddc232ca0068b285a62
SHA1dd92f6570ecd9442dd4fef6778a73c8f9d236622
SHA256dbfae6bd2b0660e9a541488fee7bb97afdeaedda1e7398a213dda24d4a4f5219
SHA51260eefde5405dea936ddaec6d7f6a1ad92f1d3e9a0679a5c971b866772b9470ca3d1169479ce3d3c99a097a1fbdd38c660770015289531c4e4611f4203b339046
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1006165ad302bbd2e2c60044b28d168
SHA154eab0c7441bfd5bcbd4c0956c0a2c683a64838b
SHA25668c50d8682796823c2c8f6ff634a37717ae4dc7f3b585a913a1ebf08bc4b4673
SHA512ddd58e6fd90a156769e2384189af91f9fe0a7c64a86c704512d07aeb0201b5ab723a03b3026d0fd6277ac48f1f662121eeeb86da6074515c278d679e78cea939
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cd54e4f66956f920c9761f2643e8c06
SHA143e786f8dee172e5ec330058efddf22739a4def9
SHA256bee030748eb16cf6359308add86421c0aad7b73ca9fd0dbc2782888b1511ff03
SHA5124ebd1494e60c75a432fab5d2eddaa5dcb25ab51b7e5c1261bd4437626725213f24a2cddbdbd5f5a9a35591d708c1dc5c47b5b33f078342c16dcc9ad33716766d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50eb2b353164277778b4db075ed903bb9
SHA1c309ad46ef45508f200aa52e5b0f3253716f558f
SHA2567f379657e32d72414b1a20526041cb475d62b18a3e7f9e51ae1eb7be85dbb7c4
SHA5120c2884828749bb0a1da4c4d97306cefd08a4541d5bc0f1522b762d65f98a841db1e3121cf9197f87a862edc38d49a74c96d0630c4a945525bb4394b3f3157607
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc6b4086322a272f955464ae5295f94e
SHA14609b0e9a626d77b8c65d1387a6d2c22ef3c09b7
SHA2560fd45076f54d3dd590f7e0f94ef65c1b96f94fb37de88c2837af94758a7acf43
SHA51272674cab230194a75f87f48be2193150a60cb4f5f684224b78f90be65379b78bcf66bcf1ae643f5d591b71c2aa6c4beaebb37271e8e887628d4221f1a1b9490c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53438b1ee61306d8a23b45dd36f9fceff
SHA1edc99f7b44503193af558095a416e13c850a5ead
SHA256c42ecbf97b4d7f90b80fccc2734c49df3c773c3eaad390bad289ad0a366c2fd3
SHA5124e27afcb103e4ced848cac29d4840431616a7fd45882b3b19b8ad77357959eee8963494c8a74060b29038e261fdff8d546075744ba7fb29415213065753e19eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4c23319330c40ee736909efd1f7eabe
SHA1e6e7aca2c5f889630ba83ad6cae4824d8199bd8a
SHA25617d5ad70780c3419f98e828541f7d13b45885404e2116f3a310a1948ba351f17
SHA512674a76df049c4f9d4eecb9ffc32f1ebc51b6b65e6dec6dc2a252cd0c3f9385b09230ff6bbb068c1bae53178f5f83e8d73bc2673b14f0579b5f01087242be6159
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595136e708ae83e07aae1e2441737af10
SHA1447dd9eb8d2541ca0c7c6af3d0f1a8444deb835e
SHA2564e26f8942f1aaee9615d1162054442cffe6f86624c3195cbddcc905c794527f9
SHA5129be30dd68209d9e4f46e87c698854953a6283b91e223195087fc77c37d906f8933f07d6f916b96f064e3131b8c4d1b4e1ad2db617697c01a165199b368726557
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52347056dc57c38ff3540270ac12c92b5
SHA144f7d41ee9d191f031ca044b11642e47320dee7f
SHA256b062b4f7858ce75e7283084a477e100a24cb06e22a1318d8f815f0b22ee0af9b
SHA5120bad8be5cf2ea6f3d02830b7eb292b604f740b8747617036215f55d4443e216c38844058bf3b6244e8a733c97ebe061abf6c8475c1c02c8a2173112f05550682
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a