Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/04/2024, 13:57
Static task
static1
Behavioral task
behavioral1
Sample
e79d04c095093e330017e1d9274a8da4_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e79d04c095093e330017e1d9274a8da4_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
e79d04c095093e330017e1d9274a8da4_JaffaCakes118.html
-
Size
85KB
-
MD5
e79d04c095093e330017e1d9274a8da4
-
SHA1
5a6bd9bae584ec86a4ab2b6d8c8d1aad73a37d10
-
SHA256
e3bb2a2039b36325bcb56756f77c03ee69130df86faf8cbfb23f47bda08e54fd
-
SHA512
8c67a9e11fcb1b6b25401f9d6250244eaabe58531ec2e89c40e0828df36d655077b9526379900f8cad9ec4e6ac19b6229bfced6692e29bd57effc55c69b91e1e
-
SSDEEP
1536:bbOUo8vFRUvaoXcRGYFqEwLBuOdO1KSDXLnFn0MVxF65HHhgP9sGRR8LJPQdYt7j:baUom0BQUXSw
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E4C09BB1-F5AF-11EE-BF21-EAAAC4CFEF2E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418746498" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af6000000000200000000001066000000010000200000000cae750e2937d5bc7ef130d52e4b4f689a8fed36ca2469060bc2c902ded6caea000000000e8000000002000020000000f34b13540b48942675572ebfe38217b8448f3e0562210ea786246a68f40f4f54900000004db4b7adef51a05306285f990b2eab7a582bf52fb46d45aed3c161b5424a5b4aafbe4e4a7ddaea30ea420fcf4d21bd217e69877b4bbb63528988fd2c5a8754248b83038a9cf4add65f1a47f66b1ba5692659c180a590b45cfd74608ae4e9d2de10184a9891b6a30c7e99609d5a359a8628666685836d4e78b0dc93d2e2ccc8452c9195dc4836d7a7f6d9a9e175923823400000003540c0c0274f46cc2efa8e80d09c8161f0741e9faa6488455d6faaa1ed9acde732150090273b10d6e602117890852264b62740da4f884c5c8a418662e4c474f9 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000dfe46780127e635cc88c9aebff0209353339fdd1313381c8a3c8f5be35c99388000000000e8000000002000020000000ebbf66e831f3af546295b236192e07b6c45174f28d3377eea7c965e272956548200000001f6175efa103f29506f55e167271cc2becc4744779d4f456b24716c52749e29e40000000a67a2fb9c9f42d179f9b53a8f14696484ba20dcb800945a13058d42b9782b42d8718dbcc8245b773754e96e3deb89f90725230445c7430a44110b6c10bfa87d1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0e970babc89da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2164 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2164 iexplore.exe 2164 iexplore.exe 2056 IEXPLORE.EXE 2056 IEXPLORE.EXE 2056 IEXPLORE.EXE 2056 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2056 2164 iexplore.exe 28 PID 2164 wrote to memory of 2056 2164 iexplore.exe 28 PID 2164 wrote to memory of 2056 2164 iexplore.exe 28 PID 2164 wrote to memory of 2056 2164 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e79d04c095093e330017e1d9274a8da4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2c8fb459aa80c1cd9ff40ed3b3789b8
SHA146f333979d02ad8050ce87194532cc1fa2e46c3e
SHA256046ee5daf1c67b54f362d5f7dedabd10333e5ff3649f0465372d304c00cd79d5
SHA512107170b583202f609a26e20baf4a1e0bf581b2e5a2afb2d67a6e9a8479722557c7bf51eb005ca57b843ea6793dfc7d1974713ebdeae7b3da5f4c0f1831b044f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b77d8d7f7e4960685bfd2039d7f471d9
SHA11cfc7b9e6470cbe23bfb4042da9eda9ee23014ef
SHA2560f31940c831d011554ca00454bbcc48d886fb7bf1b481e4e6fca7500579b5d7c
SHA5125129943d8347d9880c22aa2adb0ecfd65bd0f1e169b973b9cbb024132f4db26d5d856d5e2084524cbbb72c634dbdcf653dcccef9ee2cc9d14c7b66217555cdda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557d5c80e9e8a4133e63dceb0a2633f36
SHA1263d0c339910c738015fbd4a10789d63c87da82c
SHA25686de1858ce4df93dfefe58bcb24bd4a449b6476cc94f1f75c7f5cfdc0e239e28
SHA512b6b33c0c601ca0f3a6bdacbe1ed3dd8a35fd17df3620eb57f4cf4cc955a302164eec1ca6405b0073b08c8a31255a1d41572a753a3715a8e80c9505aee733860f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e849a509fe0715796b371bee6235164d
SHA1de0f8a185a68d1ae9b1b317a9abc1fcf28da8e78
SHA2562a19b9e317970c197180ed389b37fd9ffbfe9e7802dadf4ffff9a7c8514a05d8
SHA512e592843fae7c2d41f8cefebc73a100b0c7630cbbc01befb05bbb72a5b0d88768953bc40f5afc6db0a71ecdc949f8c9eb3070f269ea6134e4c35a00a4b39a6f21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3cabb01485ca64dff42564ed4332a16
SHA1a513049cd56deafa87da113a11d319454301b34d
SHA256027c2e243a91c11b3c45182d11a5122e719d78c9b6457eee275f1da3e3f95de4
SHA51236a1a6b51b2574fadfb1660542bdd36ced8f86930cd2022a5384622b7a5e5adf45f4211e75cced9e83a71f8923b8f5176164cdbf129c25c540ddfd62487f7522
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ed621c283d7d01a012046048414c7ab
SHA1a6cb5a8d7bccc92b695ec11820c07e59ba6efea9
SHA2565390f034d1064f61d8c23a2af1f358b6dc942d919ebdc42a99dc91b32a76cad0
SHA512890ae9bc13aecdbaffc9313a8044c746f370ff984a0479f16d4c3d1cae00f0beb30765e6323231302f6f529d4959f1d598a17bf5f49d8decbede84801ca1aa48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547e514cef417b3b1a08f0c929baf796f
SHA11732ed250a3a0da817fb48e5c0a7cb493a2b0911
SHA2566d81a0d3e7818a04eb4e4661f059b45c5c41232a6c1f01cb1c69da7aea496fe5
SHA512445aad6b0fef557367406e6a48f4b0614c5380d66b4c492505df460f9c4a7288adc9fbfa4fca957e75902374383a97370883d93a35c3470a22e27d8b1c5b8dd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550fa55dd67d6fd25eb3abba4bfb05212
SHA158724567b84f637e7ea402304594bbafa6bb15e2
SHA256e6f66b9ed7826efd01f40156e282dc79d7f84a8c01f13b8f6bcb9e36691f70f3
SHA5127cee849ec1a9b6248f4e55c09927f10f94734b8a99c10bfbcf4a8ee573dc7eab562080ad148ee5b6ace92014c9938b3a43974b588e1c47e0a89b6ee9eb1aafd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f44a35ca01a439e24b68b8e06ebbeda7
SHA12acc456676b23a427625aab96bc549d6ec91ef91
SHA256f7b9bab1463e6199024f3d7244d97736acce7e090ed085d617c1eff83dd8c2d4
SHA51254daf375d61b0dd3b30262af497e1668ef24203bad2403df2d5db2d509cba2bb8c0c0c7885a9c103f491d50373cd4805d06906cae892d40282932c205e88acb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c49be753c361941060e0d6ade97d37a
SHA1fc9089fea615d9b97de8d15b3d41b01e955deb7c
SHA25692bd07febf3112a6f12bc6f66bdf0e9f482e0645c45ba32f0714f701763a7255
SHA512dcb86336c13a672a6f5c6323bd74089fab0b5db43880e31bbed2571c053623064e6f30e1667b204d8c03531e4bc8734b336dab7d01edf728d5afc73af6a3a375
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c9fcf07824fe4f86e5e65a56162648a
SHA1159e0c3f4d76c6b3178ff8184d2a5d4aa65b0bc3
SHA25623c47916241dcc1e72d98c92b019e77107af5f5d425364285dea41742dc72d34
SHA51201529a19e5e396a5e377844f44217c5f20d779cb9344342c7d553fcfb0e6aeed2b2652eadac30be3fac2c15698f5b4fe4268530fb070d6db92890b33a372c77b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b77d1fe7b2687a4dec8a3213150e784d
SHA1930bb07cc316603383550ec07cf2200eb9b11cb3
SHA256859eec194d5fe8cb029dd8647978c40ffae99f46efecfdd6d927600f31aa5b8e
SHA512b43bc3514b4cbcd92a0e754c5426f51c61cf9e04db8269e91fb6d1674de35f3cf3a3e0829fb994c2ed622015d2fdecca5d394c320878fdcff8b7c1c0308478de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566e1701d66a57ba2ad4518244941a260
SHA14f0729b65824d746f2761035b556490ba7793744
SHA2563949141c8308989a95de2fd2a2e41d7146a1db9fdaf85da4dbe13466d3c8a7ca
SHA512fefbdf81f765e350d07b2189f80626435221514fe3c57dd19ab474f69da8d5bbfd35b41e35f40fdd42adb940c7de18e84e48e055880535b8c20f381ee1069594
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510f3ea27a71fa01b2e1869d0138b4986
SHA199b17aec08269063f2d7b704c10dcedc5a7417aa
SHA25657b878f247c7b024b83833e0683e837248433bb2e6ddac2cd4d07ed5a7b83e3f
SHA51251377667c2859dd59a922a41b1e74557fade326e3e691fcb194c74227080a7691bded691a1d9bf64e82e5f856090e344842d323680db1ce467eb85d9b1bacb6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58af721b8ce3c2cfdf06530a170298a7b
SHA1de13750a759f5f72adc3b60c578dc7ecc97488c5
SHA2561b7a916b0bf81962f5b9c0ad4defc064d4a78f33fa0ae165f1adeb2daa36a290
SHA5122c1df78bfba5e0099bea22eba92079af07dc7600c7a18e87869a775c0bfedd642dec2015bb4156baecc3be7bfa54331c7bdb8b777df882e70cd0004015fd71d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d90e9e9f241f86277d70f7772330dc24
SHA113c991993be7512f280174a835fcd3a0c7376638
SHA25605b4fc2925e4a879a9a8f5be6efdc94ec82017d09db0a62580a9ad428240caf4
SHA512dee1396c9b48af4d89a5b85131829d29993a1f09d2af9fc05263e5fcb57a401c1c80bde95dad921dd7c6c2d98a17e1cadf8d3212997dcf90d28780fd252c458f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5e1cdd2a1be335317fa2deb5cb11834
SHA1ca0c6bfcdcebca0cac497eb5ff9fb316172fd0ef
SHA2568bf3df06626b91e2a3a80c521e9608f5a1effd96728b919734d78922c5be3474
SHA512da778b58fb23567c2929ed1c81b63285ec619ffcde6f0bc244df6f24d51b48f9fcccca5f09942ef5eafc49e8bb79acf525bc0a811e749706c8764338af7b5db5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a