Analysis
-
max time kernel
118s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-04-2024 06:09
Static task
static1
Behavioral task
behavioral1
Sample
ecd33a1b4d7f0a32c0fd533823a4df1a_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ecd33a1b4d7f0a32c0fd533823a4df1a_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
ecd33a1b4d7f0a32c0fd533823a4df1a_JaffaCakes118.html
-
Size
6KB
-
MD5
ecd33a1b4d7f0a32c0fd533823a4df1a
-
SHA1
f1c76ea566f9926051212fe350eb1205b3d66ee1
-
SHA256
e943c0758897e702f825f9308908316f7fbc7c27a4c9a58af25ea5a1e2367832
-
SHA512
1ea5957ef0e6d6ce454c1d12d23c6d21fdca91145e4ebe9a84cef2fc4091fcbfe065d3ac73774d638cc9cfa7456c161b2f3be2d907b549ed2cffe532bdfebd85
-
SSDEEP
96:uzVs+ux7W6LLY1k9o84d12ef7CSTUTZ/6/NcEZ7ru7f:csz7W6AYS/+4Nb76f
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418977619" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b00d08f1d68bda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000955616c22824571933ae7a1db6dea9a424286f48a8b3da6070c376be14e3a124000000000e8000000002000020000000379a4047e1b756544621ab62efb212d7723d19efcbe7e37ac00e810d500301f7200000002adc2b1aab9bb0be172a23f8d0b071f22f98afb9c49a00308f5ee9ba128d0d624000000044c517909dd60a5feadd8630789bd15772fcfe190c351899d9e426d17a64f5431f99f2ee43fc641d1c024dddf9bbb930442c7c514d91e767ccada21a8b487c4c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{03169491-F7CA-11EE-9C59-EAAAC4CFEF2E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000000ce64e18f808925a301a37a6134fd878154dd805ab0f4905e33d710b7bb8b0ad000000000e80000000020000200000002646693ab373dcb687f4fb4ab8d5d8caed0666fe093206165e940490ef15b1479000000020383e5c99111308cca5a89e20e65924aac70ebdcba2af747dc18342a2a712dc13703d9f20b438acd8cf6b1c256c3efc03f9eaf71ca7116cc2b65d2285a6a4cbe7ee40ea0d461b640be6bc40115772654af2e4d8b8963ebf386fdfbf30e19411ef0b4bcd8818fcffe75ff57a745ffda49f4d0b0329c76d3578c5a3903b852c2671237470c0b69a1c7a1930ae7b760c65400000004da9a3a03c58c03db350fe9fe82cda172534bdecd25a0d3a25ed4ede2adeb8e3fc6e461b61a88f7bc2f8412c8b5c423619e815267199426debe4a567dd23de70 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2004 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2004 iexplore.exe 2004 iexplore.exe 2280 IEXPLORE.EXE 2280 IEXPLORE.EXE 2280 IEXPLORE.EXE 2280 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2004 wrote to memory of 2280 2004 iexplore.exe 28 PID 2004 wrote to memory of 2280 2004 iexplore.exe 28 PID 2004 wrote to memory of 2280 2004 iexplore.exe 28 PID 2004 wrote to memory of 2280 2004 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ecd33a1b4d7f0a32c0fd533823a4df1a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2280
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597076542ffa0b59a4726e6a86d3f9db9
SHA125358c443d8c2354fffdaeaee3f12abf6680bb8d
SHA256cf9c8dc2f28afa9d6ed16d8f83151e4d683c8a97efb26b3a2c5fca137d1a2def
SHA512548d27128c24d4da093e308d25b8e86e807b2d4d26ded48cd5b95cc1863d7bd52e59c0a6d7d8c24720d4dfa04e384c56cf968a01ab58838e4cb3f38bea4bbcb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5e6e693c57010b8c471aeeed873b5df
SHA19f4f9258b572604ad301c3596e4cc1f4ea35ba88
SHA256ac4342d177b49ca411bab9a751db942e767d1d41f2aee3b6b756274c6db9dfb1
SHA512c00fae19cf1d4be012aa1fd24e516f9690e33073242676be40d4985bbaa35570f7f80df145b368e8c719a1ff1ac4d86338a016c4fc7c931301f90e597f2c641a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9feee797aa9b7f71dd6c5268c42a601
SHA1ccf104d64eded74e449adaba55cdb5d0d416a31d
SHA256fe6e5134da10ee88a6816c3c2718de186a0b6045aa84f4ea3e045e59580e88fc
SHA512fe90122a37be70c91205c3232e99cfd46eac029de876333df77e147676cbbbc469a6c1171500377f1e6bbaa5c18d78ea0cc1f327ab99d1208bffdb720354d60f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d35a6c5703a6be694b235ab5ad9c2de
SHA1c673c97f2e637eb31330cc6614c3ce8b03f773b1
SHA256ef85e378a0aa103af7ada4310ed4a7df9c4486cc8e8b1cc91b150b07270f41c2
SHA5122d906fa3abc6e5ec2fea764bd4a21e251d44778365398c38050885f749c94526ecf1b7bbf80fbc83749ba687e495d493ea059a9570d4da11814a4d8b7a910277
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553418294a3e4284de5cb43e9ccf81598
SHA1836c39c7817ca5f8a923806eb189c6ac09c83562
SHA25639f115404cbdfc3bd07f5a46276e3964a64dec5e8fde9c8daf810937504c83e6
SHA512b9d18e384887d18597d1d857f266ece46ba4b60c427894694f31e5739f526ed2d30b60de2248da316e5b6dd6ea85cdd84920325571a58ade00cd44a48a15504c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55260f0a05e47083413b12360c7c49d49
SHA1be5752d1f70a4c888a9cecf15f61e8f5e71b08f7
SHA2569bf8f535f208dc37ce485176f2b1aca315a32dd295a0580cd8276f6d8493ae0f
SHA512577046fe6c1dd582b23d41a35942407d6c2596a30c73ca966147275f17218b6e77ea63301395de91bf7a06d4aad148ef98b27bd72d71014831c112451d81fb30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500ca0a071fdeeea3222a5e477d2f528d
SHA19cebd8c515164397a57a5676c6eceb2ad4cd8e88
SHA256825780f08a8e2f95bb1fdee6c353a7021515931ccfbd49a65426778e80cb4fa4
SHA512ab093d38594fc2ad53f8328c479722e890eb4541750bd0026cb1dd92fafca966d247e006393ecee19ad326792fcba32d506db55108bb038df8edabde8bc5919d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ed31a926d65d5bbd4d8e4fbc59f84bd
SHA1714d39b1985111cc3814ee04797d8c8b15ce1cf7
SHA256dbc5999297373a049d969b32d397c4a8e0e96fe148074331af092fdea5c761d9
SHA512a7be3fd0a42b6c3b097a48a4c7abfd494aa7416f123e4b7f7f982336b2bbda2a1cb69edab7bdbbd2db717683b9355c342d77ffae2ab4142d793c290756d7c31a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c05a39d4df47e65f7c7e4df5ba4996a6
SHA10465551e41669f2a648601ce4d242191dbf6d777
SHA2560632b61fb982d679ca7c0766721c009fc8d886b00c6ce7b7f25e30f48665e783
SHA51269071bc88de18016602e8693f1dfe3b24651f2adc5779dfa3b880ef80355c231cef512bd48dd9ff59acc12cb69740706b883b9a4088efbeeaf7f0366c39cb4ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c29688e39401cd113c054521526d0f8
SHA1486a504b2bd7c9fa021ca87401c1a87f7687e519
SHA256412c6f10e16189575e0e9d4529b55407d83c982d3f276f2c04f3be9126fc8827
SHA512ec16e764a15e9d3f99b761cff9ec6a25d261112faf3d55dc1eabb1de1801d8f882444281b5f699d7739b22c2fd0398847053b9e2c2cb36f80a39c90bda88d6b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9f2bdd9864a47b334304feef557d02d
SHA169fdef1c6916ca33d6c8f3fbedbc164ece87f42a
SHA2566c1453029353078f83d9a7d790dd35cc32f2207c37621ea707fda1d01b93e265
SHA512becc9e6c4c99d35aec8d37be72fb6b9b15d6b6fb9c04e5d7c78b39d1d40e4383f3cf3b1e75ca214f754a0a1caffed9724324ea633847f5e9fbaa4ee93e144389
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58fe8307f563cf2113f17dfeeb7c00c48
SHA1a6dc5e1f1d060eaaa8dac949240ed91c49c7b4c1
SHA25662eca0eb28f84c03708dcf5b22ffe4915e5044137d4f038238cfa04b78f7774b
SHA51239ad86b9c79d0c45f293f02f4ebcff7bac7fab61953d2878a1ffa5dc7cccbd3c1be91e7aa97ea60f5344003cf5fcef6329ebe117e0d0fa0dc3af907e7df468f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8cacbcb8b6c36fd258ee6e31b1ce068
SHA17136b0c02741b07c336f1b0719ac4d3d67f210f6
SHA256bbf8fc42fcf97d3d012ddf293a667033e1ef12cd421c7cfaf8ccead93d2f1401
SHA51268098afdaaf4fb0156fb3a7a2833f5d5c15b634f6ec50887319c1bb5f4a00989b9e29e573f8136db07ecc4f2da911a5ae266de1e90f6b88f883f4510974a812f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e83d9f3df90f6c6ff6127cff539967d
SHA1fbe3744592754eaccb5a04f6c9b145439b7c3325
SHA2566768266cc53cfbf95886c3de5a579b5d9fc68c04faf6e41a3f1513764c6cd5fd
SHA5125843180353a8734ed483ada9193da85de913a86236d88626365a6d06ced704bdf936acde84bb85194f5482f4a6d00f5aeff11967a4a8ffd103cff8bbc979a66d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d55d934a8161bc3fc5f4c4895cd04c7
SHA16e8ee209de1d43848ed1473bef8de5d95f4cb22b
SHA256f5a79676257e5e8a01131243c0eb7ee9861b50aafe9c3f9f13a307b2f7e016f0
SHA5123834e13a7f59efb90dd69ed6090fa760aa18579979cceda9d4f019a4cbccd262350aa27d00027226f711a0751ec2937529e37530276a60c86ab6a05c961079fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532ebada575f49462865831731bf1d72d
SHA13f61c47caa680db83abec07e289dba7dab2e5347
SHA256ea0ca2e79896ad2ce3a0bed17d0bd938ebe4dd5c3f622c836c7c4a33a98f6550
SHA512c50e7016414756489eb810194a0bd2e68dde4cff4012e39e95cc6e03fce319332b5f8aedb864129b48a24230bf997dd4d0eecdb8aa968bdb07a6a73cc41f126b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5232dff0eae3c37320855b751d4e81322
SHA19470ab14af8178fb3ace9dbdc9debdb845e2d240
SHA256a317ba11f620e00f9173cdc05a55967499bff8d1ac0632420e0c1f785a122bb5
SHA51290d1b84251797a305e8aecb7337da30d6ffa6c337ff3fa4516371ef5dd543d37850b767cf87c57606b4788a28a21da306966020896b64585dc37f42bf32656c0
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a