Analysis
-
max time kernel
120s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-04-2024 14:02
Static task
static1
Behavioral task
behavioral1
Sample
f13bf6fc54dcb09f2edceecfcd5b548b_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f13bf6fc54dcb09f2edceecfcd5b548b_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
f13bf6fc54dcb09f2edceecfcd5b548b_JaffaCakes118.html
-
Size
23KB
-
MD5
f13bf6fc54dcb09f2edceecfcd5b548b
-
SHA1
5fea9436c95924b047c9056cc0153d8f770a1dd0
-
SHA256
c38c8f03aef37792181fc8d13e4caf09abfed8aa2225823bdee491eb11690d3a
-
SHA512
c1310a1d90a1ba68283d74b9353aa1d1e8ccdbb0c68aecb0c5db722c6503e6fa141b4872cb6228972cbbaa5448a1d25909f671cde749b60c582bf89fc9a1e92a
-
SSDEEP
384:5nA4ywrb6pzc0yztvukeKXXTuiwvFRNzC2UKL24UTpNyOcn8tvG5nTDuU5esT8a:R15bxtWkektoHQ2UKc7wV
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C35BC771-FB30-11EE-9FA2-EA483E0BCDAF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000b3d99334998e86e94f0f3238cff2a7ba798eb98b48ac6714399ef7b9f50efaed000000000e8000000002000020000000054774717571935de25479c8e605174cde9df2debcbe84ab77dc572bdcf4d5b090000000208faa7a2d22417a3b5261ed8b87aa8a2dfbf7d1c89cb14ce62c9a79707d38f018d8e64e541b29d4182953d292876e3da7192372313b34126e01e6c035ab33201c846bea0d403866fd8fed0f965b1181fa28355c784efa9c6d673bc7033c4d4bffdaa6a6b465c523f2fddd8a45b3971d394b6a5d87db1453d64632c13622180662322d0fe850dda80c493d74c5d95eb9400000009f8042f27ea689e220bf85fcac7cb6a5b683e63ad7e91c70d6175253859ee7bd1823fa9fec82e41e8c8a3bf08d4621746e1c93f9dd1bf6567359e1c7b9ebcda1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000001d304c21d1a908b00c810b0a8629966b72098bb9ecd9b02c14e860a5ffdfbcf8000000000e8000000002000020000000f906149b808b268b5eb2bc3de2385f65305229768586d490a785d3fb3c6a442e20000000c7f5927348a4f2a40233be760536a3d140ee467a05067a64ddeafc038861c14840000000594016db7b01d784f361175a57d5143ea5a2396dcc8dd07a31d8780f7c81f9952179fcd1c00fcf72e25f8638146d67c0fe71cdb5f7edb5aea5bb6e51285e40b9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d00b74983d8fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419351603" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1612 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1612 iexplore.exe 1612 iexplore.exe 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1612 wrote to memory of 2744 1612 iexplore.exe 28 PID 1612 wrote to memory of 2744 1612 iexplore.exe 28 PID 1612 wrote to memory of 2744 1612 iexplore.exe 28 PID 1612 wrote to memory of 2744 1612 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f13bf6fc54dcb09f2edceecfcd5b548b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db347633d9c878f198e9d4de7560580a
SHA1defc18ac63cd21700834869eba7654ca4c70851a
SHA256a4889cdc4bc700ddd876f15041a834b4c77ce8d737244d2fa24642fd57e64065
SHA512d6f7bc12b92338e89cde16084a716535454617bd07894384816c43c89b6085d8d057780a951d799a25e3b40f76fa2453184d6e89a387e7e2f140f965320e8872
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4162cd24d50604a586ea459437adcd8
SHA1c33b91141473eeec3c1a486a9161d450aa22a1fb
SHA256ae6f970be78005f334b0c6e4d6d374bd90f90bb8c8aff46008566f9258a4a430
SHA51233777e77823e4ae22c3848b4d1a0da33ffc94c4fb307b9bf2ad2c93930cf2948e78e06aee260c36393c10d14bf4d207e3fc84db6e6d1d092f06c3a785fca2851
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2e03729f9a178d734e2c5bf699daf18
SHA1fa2abda28cbd00c3436fe6a2f0aa1d703cab5cd2
SHA256c1dee8fc0f6570ee40034eabf432994bed05bd62aaa6f252ea5e2ac1fbc9e716
SHA512a64c2eb9f14f197c38113c29dc97b97b397710c2ce406142edd14cdc204865126dd68e74d2f9544378eeed27fcb73899cea3ea62ec9ce74fea07453a04558418
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e1aa3ae56d20015a74117fee9b4d7c6
SHA1802210d2118cbb3d379b60276fff42544f6d852c
SHA2561f92f83ec49487c197000329cf5432197f940bddb06725b97d20457e11ce1850
SHA512841546ded7d726b840ec66601162ec17bf103afa9bfbcdbe18491a27feb2aa2ba019d41ab53ee24f6d02b3d4f26ffd8b37884b6cc9e9641bc8b341b5bbc092ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d25c8c15913464ea55bda923bafe6855
SHA1ed750ac6ff8c7bae3163dfe95848bb4131a4fc40
SHA256a83018b78a5a4215b3b8de9c74fddd92b074c8037f5ca5a7eb9cddf5c36397f5
SHA51236cc82a1ae51d785758f7a476d10581ca74cba6d819500aff6758c64bed703167ba1bc7abd42d57a70210c5dda7e33af84110205f8d82ca7458887f882b9a108
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5722e59af6cd196392bdb88bccaa494b4
SHA11fb32e820fffff19b5654a6f3e2fcd51d218cd5b
SHA256813051145135fd140f1cc8996400d460300bb946836de3d44a60ff319e39c374
SHA51207879119d1c84c71848e7fc82905006601a953f69874b0c07f04b7a0a196007b13f797218c0e93269b26da3d4c40f253b38f2ba0c33df71be9b59a58ebb9aeab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55216f504f8e7247bc070ba36758e0d59
SHA1a707f9e56c3ea61f1f007b5558966cc75d3d33f1
SHA256caf36eecf00a258492740b57b305916ad7509837dd8f31ceed56d50f056a3420
SHA512a8c31a9bfec965698011584888cc2ca7ec4c83dd19c952c0c60ac50807b8ffcd0aa1b2dbad25d0130c2e3e64ffd892da95b11102e9930018cd01a53c52730ce4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e35d37706c100874aea773d0f213db94
SHA1b93e805f72c476addc47b81e68f316b5e4eb558f
SHA256fe4d3ef9e1a9e7979ff4788a6cca2a89ef4c5113dd929191025462865b45e679
SHA51244ce99bf03e2f58d7826ed5228d97f13d1a48eeed47926323622a23fb09e7dc6aeda9841d18cb9a2ee4bffcfb6e3a6db8f5fa0ef5c9fb705a56b2f3824136217
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53608842e9f5d0b1ac9f00a3f8c3a415f
SHA1f13bdb5af07601f5be18ac86c8c6b58240c597cd
SHA256dac1bf35181870f74693d5a39fa830c251b23284f09717018c9a9ee84ec5a99e
SHA5128ab63d749a4cc83e0dd796cce21718965d8ef495a6da921c1daec2bd45a50b4d726fb87e4cc408236f27b6646569f65c5bf22242cb5613a58d986625d2e742a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb9d9c047ce4b1986ede17392adb453d
SHA1113a224af0a07a9a725339828bcececef59ba3ad
SHA2560fce957592bef0d55866e9f701284f490b02bab7a600d902ef187b32b84e597e
SHA512842a6e374465840a2f83ea2d4c547c7582f446cde76261662f9b37372c3664aaaa45247dcd5378eb51150915a119d361e6b349943de47b2b4f0b69c227f6dcae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5513a60b9050e935ab50336796f45abbc
SHA106859ecbc6ce87a94a47d83d3d569543975659a9
SHA25628ba439168a09431168c1e244f5ccbb59423d14548bc8a2c6cd2ff12b04b1218
SHA512863af9409e9769f9a2baee536141c0f74bd5d73e71ba26eb4f290957378bbe79b6d49d965f130e036ad4f66510d66a5de0d8b086943807ac377ae9690cac17ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568c7433794f786692e144c27d77100d0
SHA1453950d35d32a1cd2371a1b9fd0282d9500ae26a
SHA25688308bbbd84ec9cafca5c385038b511b2b1bf2e3e34e48e333ffa5f335b33fee
SHA512ecf2aced7c3ff70e0a743fdb061850350a12b70673a33951119fa4bc8c5674cc75ae9ba2b085edc453445e5b2a88940cad988d83be74647c00cffa8b92358134
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55805a163091850b67802f36bdf022bcc
SHA1f5ed79f5aaae51b92254e06d9a0d74b391d76636
SHA256d5bb7fc6f1f1cffc23a0d3427a2ebbcec12c2a8bcea59fec18111b078dea26ed
SHA512aa688a6ebe23b7680341c6c7c8e085ecb10ac2d37fc495e3abaaaa0920d0ac1a9e651417c764add905fbc9ece2b36b28fdab6c9737a66ccdced64be42bf6caaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584b75cdddcbb44ccb35331bcc44fae6e
SHA1ea96a20e1f49858a0ec09d77d9b0b304e8b6121d
SHA25671f49f0e8a28980a4755997387676154c4982055350b27f187fb38133e47e227
SHA512cdf74fa5edaceb682fe2c7c0c987f7decb192e8d3ae7f3394a667c37bcde207ed520483a8c73d90b7a76f2906f7d8ed033a3cd57767ff67a91149e898248474c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5129b7ad2670d6e29e5b1a8534e331fd0
SHA13d15937bf9d5a87e59fae3b253b3c5fa1dfc031f
SHA256a2bc50d20bcae93b014501e1b7d7a2886fc1c02b016005897c7381e0c46512d1
SHA51259002cb84fa3ed3b933a0b63119e8d96a7d70bf2274730740132848ebb9054dafad2400aadbd62f2609faa6089cba850b715f3465ab90c3e1224e96c4b959d20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbf18a7644471b9ed5b302595b7727aa
SHA169a05006b20c504cf82b606f26a5f7bdf1fc420c
SHA256f5aaa12ed94d55e289d8ab58ebf10e738858712c6dd8af6379989a473cd4d4ef
SHA512f4befef8338a2e13d6ee27ad4c52d68f29aa90fd9aa138448be96b840381716ae4fe0299f6d5cf0047aa8bf5c8ba9b6e7d005712231824e7c8c3ffdff06b1356
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2b6a66cd2424c4b9495e245976b86ff
SHA1c6f1eaa0cc4a5ed11af1e9bd067051536203b79d
SHA25679e4ed46cdc6246415086d418bf1325e6d2e9f66c89c4b83c63eda00e530e370
SHA512c91f4d0e4c1e5cb1a4ee2e7654f5f228086537a6e0e754d4de9d9a50dda06444adf42317135154d72161ff85d19405f14204a6a32ca20d8da616565144fb7cef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b94ef64f64bc485b8e2e6cdb5122e4d
SHA1dd0a5f5793efad494504425415263eab39a8904b
SHA256f0324faf5279c000e3b6eedf72de2eb3b9f9f8133f9f4c82e17e20d30567f7c9
SHA51288c6f5ac11cba798e531e4c150632710e824556032b45ad09410fcfacbf5a4498a0785606b540bc5b4ab2b8eaa27248c0748d14b05aa0c54085f6b58b8b1b690
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a