Analysis
-
max time kernel
118s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
16-04-2024 07:02
Static task
static1
Behavioral task
behavioral1
Sample
f2f2db1117d8e0cc919723a177df964b_JaffaCakes118.html
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
f2f2db1117d8e0cc919723a177df964b_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
f2f2db1117d8e0cc919723a177df964b_JaffaCakes118.html
-
Size
7KB
-
MD5
f2f2db1117d8e0cc919723a177df964b
-
SHA1
a60ece93818b1cfe1236481d0bf2c4bf6384b37b
-
SHA256
e4b9e666aea863ea89c67fa692394683617891cbdab3810ab465f805776a0ab0
-
SHA512
2a9f7171752a8d4e1218cb3184bc685a3e4f67c417056cf60f44e259c996ea316b4af4944493b659bda79b7b31964888ecaa8ee9d63057f71e4e7fa0dd285234
-
SSDEEP
192:UT+6teWWE7HxkMdMb1sU/w3K3RBq00RCRZYFgbVg:UTRtJ7RzMKX3K3RB0yuFh
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C4178C1-FBBF-11EE-8572-7E7D2891B4DD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b2000000000200000000001066000000010000200000000257da3ae7ff993b15faf54e7b4503a76d3937bc788b87b47cf836fe0170e6df000000000e80000000020000200000001366907db1098ab742fb8e5d0a28d77e2a41fe65ea734a4a4cf31be448bafd3720000000c04887fba554409f6d9d5ef550df377f19e1edaeb92802047dd7926c8c4560a34000000063a9f0de28a8f3741042a8f95e7ee38f12363e9a7b0a03dc4a046b8edd40b06e8781cd564edb8281fe9d6b4796a0fe685c81aa7dc32adcd936246c38699339ba iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b026f433cc8fda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b2000000000200000000001066000000010000200000000d6251a5b8f5c8649885a5b239740a437452dfb101f25ef6b800427dc06e3e9e000000000e80000000020000200000004600154a52a4788f9fb5dab709e53c7f9228ce0a733392ffd76d0199e9d6f6a6900000002b4ffcd4584412d5dd2dd96e45b3c65b4e62c2df41ec06bbccf35254ab17b84f89d689e36e46c6c088d881e1ca42bf7396f2c6ba695cf3d5f2575a1af30bf8772b61d6bca3af4487a1616056eda6f733017434beea1c4fdef676e9a28b4259c637ba7acc833284c593235d6082ae05cb927216e0220bbac27421f14bfd987e2a2b416ff9700e4f0f786e60ed3a13017f400000000cab874afbff5a5d61d0fee5a05add7de2435c4ad0f011c07f281fd225190e15b3909be871f21bb8d6dfe6089bf0335a76d1a0a11440f0e06fd4bc0234e8f2a3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419412849" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2376 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2376 iexplore.exe 2376 iexplore.exe 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2376 wrote to memory of 2532 2376 iexplore.exe 28 PID 2376 wrote to memory of 2532 2376 iexplore.exe 28 PID 2376 wrote to memory of 2532 2376 iexplore.exe 28 PID 2376 wrote to memory of 2532 2376 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f2f2db1117d8e0cc919723a177df964b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2532
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598c8d79d217cb7d8759be98ce713fb4d
SHA14b0604b2b3d87b17b2ae21850fdcc873c1a101a1
SHA256cb3914aed6e41d2462767ba2bccca81488db5a969a65f43a7c76ac76fbfa5083
SHA512be3af82da3dfdc941e7dd24cef86a19915f1c6689f9ee301a49ec0153ac9c8415ae1b9006f53bd3ca926b21342c773a6a817022b4e425f76f2e25dc1e27d308a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d54cc574a02dc0b5b16203fad113f599
SHA1b06e7a84693b7a0db1d6b6215fb71f60bfbb6fcf
SHA256188bf645312c36e30b65c8c81c5e3c512232514625226c42296d1ecd196ba5a6
SHA51284d869ce79e48df686a5d4538af521022cf49127ce942842bf0e3cc930c2da1a67ea4a5b1064a70c76bbdd70323ef90f69012b4c871d6f7eb9bea0e874dfe449
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593cf7f255bc910bdc206dbb869020a54
SHA1f754d445df1c573361fb9b439829bda566f219bc
SHA256ba64095ed16a68968e04c80b2c13f1277c3ebf983d26d5eb48c4a0d5324c4ce1
SHA51296d26145cffcf738fba0c3e28d3af4be58c3adb6d8033881ccfd82128be3c515c1a0383496ec84ef3fc2706da8a2c64c31090f4750e14910d1bb42b9684c86c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ce5e0463bc5464e655bd9087cddcca7
SHA13d2a80b8d9dcf8d98ddba52c9652de63db827ba0
SHA2564c990300a91f6d3af976f3b4d4b228fcb8548a479e76242a4be820f5fb70cfcf
SHA512360815b72f9cc0c305e40aa6044fd2dd5714612163253c6be8e26b03d18880da2df14e04cd0682569f086ef385b4831311eadadbcb4b05733e7fc5ba74b7b16d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5582b16b6567bec64eea756739cda8617
SHA149b2db802e135bce55cd6967d206c08b7422c372
SHA25606deef14e68f8e37a4d84e7140f776f932cb51a068ebe88596f3bc141838fbaa
SHA512d4d5f4bd9c2b559c7028e8f9de5d27f4a85fb39d8b8e8aaf4deae35ee8ddf573851a413685403ff8372cd916c37ef9a636b28778b38ae78e11ff93e9adaa0a14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54739e5dc4eed671eaff9377bd3408f47
SHA15d08b6cc9f91c106cd926ad34f9c8c1af2b0e6c8
SHA256962a199b2f435f68ec819f1967981a72aa41e05a7ebafe3b37b2ddafea1113ef
SHA5125e8272d1bfe0c877d542b69a28ccdf6efa79252cc8b7135e15ed8bb5a0bf5f6aa927fea841fd10444aeb8fb554c5231ad7dd349b8ba31346978da5bf233d6d7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5897d02ea96877df8cd5d520514ef0388
SHA1940cc98af6dbee7d84842f7368da9d8cce5240b7
SHA2562f60f81af684883fe820119ef64d691c08e3d67ab8ca678f157b5e98362e90ea
SHA512f8101c7fb9cf034847cb7dc5505327300ff7749f64a87db18807057b351ab9734434a61c962210a11ae9bb0a28e6a0c1982dfac96b89a1e9211df7f6847a1199
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc49cc83b9f2b8ebe9266ae2e23bf70f
SHA1b5f6908aec9cfbfebe2c73d2a63d344f70c75900
SHA25603daf81b915e5f5494b91ce8bc71abcd98750b0e65f1173cf93bdaeb8c07435f
SHA5120436a4b5ffca85422c6f1b32182b91320fd9fd85c06b35b08dfd395b2acffeec139d5eaa839e74f81ffad3230ac582761328c87bb2232ff8fa87fc6742871905
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a759bdd2c7258030a95f39e07cb4e669
SHA11b0e39b4d8d35a02d50a96aaae3d6adad3743d8b
SHA2564a835969aba29de98f194642e5241e81d07733f3283c8567caa2c5999a132e40
SHA51238471127ec1c0915af41f1c3fc8bcdaef6e0fcfae7638c72fa9d2038a4413a2fd9a1fc4ad610f0b70845ada1914df55ef2754ea46bd6f951e97872990914d807
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d3e1113be933a4f88ac1a292a847d6f
SHA1a14fe48b4dca0d37fe64be39f9c84b93662e803a
SHA256f4ff1e0f137166b560036abdf8562b6b346af8fa5d416a0cd1eb47f64acb393b
SHA5128184e54ab87c0ef1f2a75bbe38cac9ff1d30c210e594a3b0a49f935a1680c7a750a94304baaea90f5083071c2dce6439a6c2f62fd777f35faf31d9b928acb665
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ddc4ccad6dd6e49afbcdd1efce640e71
SHA17c222b07177c34340f46330ce020f511ba874ce3
SHA256a84eba72b28768dd68bbec31aabfbef9c4f7c8dd70a2d888275da10e713b2017
SHA512eec41e87dffe9f93419d34e1c632fb139ef9b01bff0288668fac0e8b31192d222b5ee542d1b2df60a22bbf00c26e3ffb1df8830cad8677e32fdaa855c3a92e32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c4e31617f35e476f067d9795a6da15b
SHA10fe93dc24876a297d9325615431f018a16c7d200
SHA2568bc07205ff5d3e39e17ffe167680eee72b066095a113bf3b176735f0a026e397
SHA512ab1bcdc718265da5aa6b7a5ac28b9efe3d63f0fff1b847782f7d44fbf2dfa0b7ae733b096babd122646a76f1726b82eff26b8d25bbe37ecf50e37d37f2354d80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56bc3ced718fe20a886579129b586b9e3
SHA17b13e7820a70cba5453bb2524e213fbf678c810f
SHA256b8f39573df82f6063d516cadfe85bc49624c74bd96b7e996a44204e07039119f
SHA512286b6ad4d02c51cfeb4cc8cf135f0ad8955a99f48e4903b35f9446c721ea80db35c319adbeb9caf46fa8481976239953f5f5087e9539fdaf5af537b147ff0721
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d59f79019be5049d80b94065aeca3eae
SHA1cba086466ca06a47b6715dc41c0c0aaea2d27d32
SHA25665b5c6936353db91f720ae0ef11b94928bcd63ef2889ec329cb75665d93f8178
SHA512cdc243e7b02be7df80e5e6eb790eb1d01a0f085493e7eadcbc73bed0e5883eb1366303ff2a15aeba15eb4ebdfaa703c28f6da96a0e774152f5511ee7f1771897
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54459dd84a9b2fcc8359cf1b96bceb5eb
SHA1b97b0bbc4a27760978eeb56e4bdc7735208f75e8
SHA25699f43781ce7193c5e8a070014345f2c48d04b863edece64f581275ee7637cdfa
SHA512e7474e71540d8d8256a637dcc4adbef35c691b69bb14431c410f9b2e25441ee21ea024e067d9dfc331cce6910895623e0d21c65ac66a7be06a25fa0dacf54d21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561670e67479d77861914a4918e1ebe17
SHA1bc9d03943dbf5e9883ae4650a65cf110a654a890
SHA25615df6d942f5c9e46b10fb7de94bfdcc1b9ff73eab8c00798217a5030489ba54c
SHA51282df0cead5650136328db2ddd832c30f244aa13a5da42a38280c0fff7f0becd6a12b9bb3dee2a74ddf1a4737b46585b8b2b8cc70572213a089464c895cb517d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed3d26bf022c2a265e4c9c3000793dfc
SHA1aef41879291a456b275d757bb58c8accaa4149a5
SHA2568b5766da5c4fb24a1f6bf2658306b001a23320a4a62729f7a038a74eb36a7ab1
SHA512a8a552382ccf9740b045019edd49530bd87d78b41a1055862a17fce510a279a63d851798be83e85b94281251f9f5a84ffcca863eb14f568cc7e5c2e075e39ce8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565b31211ad5d69ba881cea3f1a31d5f2
SHA192bb424f2af40e46a59a215cb7d7ae8c280315b0
SHA256c162b60d6f49a1b9baaca124333300e6aec59feb7e8882b0ab0bbce39092d613
SHA512ae7b61e007145eb75fec6bfd46522cbae71714eed0045faa2c8685e82ece38b0bf7a4b59e14d6ef07a91d87d5312707ed0b5340de75ae020bd5ff7445eab878b
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a