Analysis
-
max time kernel
118s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/04/2024, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
e7984c5700a7155b3cc6f7606bb534ee_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e7984c5700a7155b3cc6f7606bb534ee_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
e7984c5700a7155b3cc6f7606bb534ee_JaffaCakes118.html
-
Size
61KB
-
MD5
e7984c5700a7155b3cc6f7606bb534ee
-
SHA1
a93e5306dedd44265d9363d0604ccf10a57fbdbb
-
SHA256
f663222cda38a6fd094d7014fc1d7ed0017fa51d4a592b9513bc27959c7efdc7
-
SHA512
667af5bed602046816e1eaeaf412056530c9719af6c15e827a849709f8db231528be909e71ae7eed6efc9b99aff7d1e72a9c9760f3a6330c4026d300e2432be1
-
SSDEEP
768:KuOeFlHaz6ePYy8h192E4TV25ZxQOTWmYr:HYw7jhZxQtmi
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30225f2dbb89da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000815215e95cb6ef25982704d2b75182a287c143fad6f45eaf09b0fc3c831632c8000000000e80000000020000200000002f548a570d3ef48742aec57f3efe26382a5c2658e5b287f427993f85877515d220000000fff8c24de2fdd7a8eadfffc0f13ecc5e12444002055bec98679cce15b9d340ad400000001045be8cea6386afad6946c1b436769ae203b4a098e92a1a58a3146ff47196759694468003b32587125f3694611d2aa65a004251832bd926556bab0ecbc136b2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000e6e01c7a5f37ae18c9221829efece9c67d731f51edec8b07c3779d22822013f4000000000e800000000200002000000077bc89094048d5606b49cda1b209f0ee1412ae8c91b26bd7050f831f5caad28e90000000777835a0b3ece5dd0f65b7fb497ed5b3180aaf24cec6ceaf1536a679cfe2a0c9bea20180933eff95b79629ecf01cab92f2afa356fdd811805761b9c58bf5c91505416b9c329a48085a4b555e92eaf604c3b3c2d6374d6f80c22567dd6b9ecdfab374b7eeb936822cb7838f73c8c852ab510c7d70401e8f8cc793247fc8f68f584b06a19b9aede4fd5aaedd7b715dcd3540000000297749d09ce2ea951c0b59c2d1307971f920dfc916d6e80e1a4e02b783fb750ba12bf624ce832f316abfd511193cc7f9e33a302b32f8eb27d44049d955a9f4e4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58660661-F5AE-11EE-9CE4-6A83D32C515E} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418745834" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2908 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2908 iexplore.exe 2908 iexplore.exe 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2908 wrote to memory of 3000 2908 iexplore.exe 28 PID 2908 wrote to memory of 3000 2908 iexplore.exe 28 PID 2908 wrote to memory of 3000 2908 iexplore.exe 28 PID 2908 wrote to memory of 3000 2908 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e7984c5700a7155b3cc6f7606bb534ee_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3000
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51070cf0ab5072c07b8711243249223b2
SHA1a689def35f9825b2321d1da9e77b0ff0591103d5
SHA256b54aebca63d23732cedafd7d21ab0ce4f80dcb033079d79e5b3dc72f9665485a
SHA512b6741d9ad6fa3fbad1f4bd074cec9664bb9688fb31452428a4204d851696f97ba471353609701e40ddd7ea2c40187b38fde0c6319997d705f3a4520f9c6d64b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573d5696ecf0e6831b4af84fac0c88313
SHA174e375c2549e739128b2c3c99092843e5906d704
SHA2560b1d53bf05cf4e62fa44a549c67a17f927e78ea638348f0c89114fd63195d7b1
SHA5125ecded5813fe12ec2953951e944a16b62a8bda47473526e8a55be571366b8c78028b1e8690a03cf2e84a4c35c61ea5ac5358148900cb01f2d2318cf655668e81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574f4f8ce360a7787c7feb00174f307fc
SHA12b8a4c134926c80bdb1b87e0db52d00802df764b
SHA256031e2493f0858c32424497fdc53fd020e0088818d795f8b6587cad86619035d0
SHA51259f426a560f46a9604af86d92bacb7a3674583b30dafef0d0d918ed17b919ae1f87134db20d47a73cd17c117a0aff74b716bfd803e5736065d5af7d1766b6b2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d256fc9e3e96cad202ceb3a679262b43
SHA1a17e20ed682f4fe84633246e9e9225ac9f63ad03
SHA256ae4ef4cc534fb999a632fe65b95e92c1e14a5ceaa709c81d4a7fe8b80d5bbd7c
SHA512bf22ff31a990c3d17d3d8548fd1f25035547d20fed1b4625eba86d99a80adc6ffac64a1cb69e9483962f1176425bf8c07aed1b141481abae1105aba50b9384aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560832cd4b1466c984111f1854a7f95c9
SHA1460d9027f657de694bb3fbce4c0f7295a1440300
SHA256e717ce5bb55f585b174678718d1f884de7de8a42ff1cead090cf00dbd461899b
SHA512165ad86f9b693c18f9326fecf97b1aab468e14a2afdb843e2c8d0852ac7460da048184531c6e3a86f10bd6e2f60fea7f4fb7f78f82585920aaeade3ed9718663
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562aedc2dfbe32a04e550b267d3443bb9
SHA1ca325e93110627325a7eedbddd3f58b6bab9b550
SHA256cec5e09bbdc71591f0bc6872d3b6a40957bdb2cd8c591a00381e4babecba347f
SHA5122649804701ae6ca792004a6a66d341c99a70409f1eec88e864b5a0ed3081e9012c332b830dbf4b789e1bec2ba3ad0a0d79ab1c8739c65edcf1794828307b9ff6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a1f4102bfd2045f2c2234ddbfa199a3
SHA1ccb42f98f656c5f731264aec4a525e716f7f826d
SHA2567fb2e1f74cb82dad670e5c42338967ad64e2677850e134bd9a5893c97db48ef6
SHA512157cf6d901b4f2c532bfcd9ea799f1808015b5e067fc1b5e52c749fad1f72b3e81a4a243574c458af84fa2fc98538b512f38381325286c8e387a21a55e5f18c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b45e9cbf50b2a3c52ecf59ee99660ac
SHA1a2150e3538346d0f3bb0ced86d2b60c1196eb422
SHA256682e278f3ccc5592dd86b4d2ef2c20267eababc2ecaa000a54b47c8ab0eab64c
SHA5122b9be6b828ecc95d854bc70a35f6a4013252dd1cc9cdd17d4cfbca354105b19b5d9c0c300c68b204b6ccc992bb86b1cfb1992e0f8f611a6355c9d79b5238b560
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c0cdcf176be4ae4a770de16dacce380
SHA1f29a47da866a0bc06e921b92dc407ab50bf6efc2
SHA2561aaa2d17510fd6ce2458d098b1441356d7c9bdbccfb2e544fa38f4cdebf49454
SHA5126327caef0557c503add7881e927dfb1b92e4de5f8b3ed7cf0f383342defb8b3e66546507766b2a770274e97501c9a2aa1b9f4d71b72eb53c13ce0408b88e1d85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c01d5e8e5dd7e8726d3b3b061e55b95
SHA1d11843a8484dd47ce49c90c2646cb8da3c1fb2fd
SHA25604839875de1e836308160c922d8011e294e67473517b0a4eb03c50a7ac0339d2
SHA512f8712e081cd4b4130151700ce647d070785bef122a951112315cc86f7a91638d43f0a5449f1ca086193b4f37df57d8831b81fe0fd7dd3e01ae894d57988f2b73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abe9ef1f221f0ef5521beaf8fbc1bf01
SHA138637017bdd51cfa078501b286908a7d38fd1856
SHA2566dfec1b78d19fa149670454dfbeb3cf0d5e349b1a35eb277c36a219173de308a
SHA51235fc69db587989d44e41abb626d8ebc353d1b9a809528d6888baefc2984b9ffba515f2207944a243ab6ba5dd2c287d9f0517f6c6bdc5e8574b5dcbb7a82714d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51976fd4bfa23cdde4d1d9e5ba51ae412
SHA12824ca6e9d141a973d51f4f1498373042f54c2b1
SHA256120f7a6a3c4ee9eb1130f71a77eb0333fa7356602234db1c8b01366fa9f69555
SHA51243805b7af10d9c0cb76cc5ac7b63aba66df8cc799a82a7d597b239da0e48a7e05295525e32e96ad93f991a8b1928264b5ce1591575a4e1a02959c9f1b7737001
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f225d3a441cafbb7207e86b2a0b57029
SHA13a1b0d269df9a44c4ea0f7657841d88664a643e2
SHA25611f51de0aae7c8072e85be5eed9a441d871c9a87d30e7b803d3bec9fe343e2da
SHA512999cfdd5b55c5e7677d571821632f31647c4956fc28970739850559e73efb55714f67ea9540fbf5d6afd166ce7dfdd134f63bd65d6d5395abd3c092c11294c3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6b3fe55c226ab03953554bea43b8c9c
SHA1bc04900e5eef30dcdf4ccad0abf8c75e5c512907
SHA256ccfdb097abf5f28dfd6dfe469b97525c799843397f4ae13738b370cbe23904d5
SHA51291a34677c68abb5ce59fa0edcbdae54c702033862ca0a22b942aa00f6e45fe5d0eacd21fff7a141c40f58edef973c55858a187e22f3ce20cd934b9179555f4af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5468d2e644b5bde9d4d012dddb5f93d42
SHA1093a9bff4fc5a02ad5f279925fbbfe10742e36bf
SHA2566784caed9dc3e5f8ddf984ae6fe43a07880847567064ab98f1cbdaceddab2922
SHA512629e3f193e5b6afbe46336474c06cd319d24ed66123601e3367200ff598f1bf3499d3d139052d83c95b872ac027309c7e2c87337c311f764dbc5881e488d387e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f358e8dbb2044da1100e2d9981676720
SHA130cd0d464f18c3f54b2f4b73004757ab26fd32b5
SHA2568a44ca21103b3e48fdc409cb0acac75edab706177d2effcda6c54e5eb19d8e11
SHA512b1b9082062ee552951eb48342bb1866928c178d1642053ff6b34bf259edd237c5516c65c9c66c818630fcfa874357bda2725dcd9f14b65ea26edc76969ee7ea4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efa187aaaa102e74c6828fef1f099a84
SHA104898f7571b08a0aaa1ccef4e1cfcff79e724125
SHA25640fcf2028ee4bc6c42d1a1f9f30f7762099b4cebd9b6fa98ae44100b102c07d8
SHA51279d8fb67425ae1db2007558c75df5eee86052c94d3ff4ce8cb09cf9747b5c590c1d18e7aac623dc5ac2d42cb8a2e5e096bfee577f1d42bdf9a7a385022dfd0f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d2d6aefc66c114a502cee05c8ebd3a9
SHA168d2ab19cd949fc8146d5959a65a4894eb2a9424
SHA256ed0c22ec62de97c0fa9e657affe8d790ebedfd25e567c5b4dc65408578e83a27
SHA51254ea4cff5705dbfc36572d61b76243be5c5fe1d576160c369f4b1182bfa0994e63fbe4551f7cb9c42194f67548965830defb0f443d7a326a7dea759eecc24087
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a