Analysis
-
max time kernel
118s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16-04-2024 16:11
Behavioral task
behavioral1
Sample
f3d6de0e863fe521a9ade07b74b8ee73_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f3d6de0e863fe521a9ade07b74b8ee73_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
f3d6de0e863fe521a9ade07b74b8ee73_JaffaCakes118.html
-
Size
5KB
-
MD5
f3d6de0e863fe521a9ade07b74b8ee73
-
SHA1
d97cc99c76a12c769cec007cec530e98ee5311f5
-
SHA256
6155d97b557650957dfe6abc1ec30149a9537bac1a3d2eaae735a197bd8d6d3f
-
SHA512
0a4e0d158dda87d1d0edf9c5f1c89c9b07c1ca0d7b6339f90dc5b2291b53d04782df01842a6a5aeb8658ac3fa66e49e1c2a58360a060754598ea1c8efb56b163
-
SSDEEP
96:8y+cAl5azln+DtZogA8rbOjQL3D69aiKFe8LDmQIjq:8OAl0z8Dj3zDSKYQDm+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419445732" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000bfe0c2ca82d36de39508e4850c32151615a60ac9dfc86ea80778bb29f5405f29000000000e800000000200002000000062793dd5a2f8b5853b11ddca0aabbb1bed711015c771d0980d4d81e094a7f66220000000820f6d7a997a3e3295cc2144bffec886d1d1f7bc865fb50b60d5700d0e620e8740000000dd6790ebd494e053a95646adef0e11bd99a6b4cf221e44d0359ef8d7ec2e44a9adddb5ab398d9934209b76174f0233da7b0d13f412daf3a61958981962ec30c3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409e22c01890da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EBA37D01-FC0B-11EE-917A-EA263619F6CB} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000a22ec06b931fc22f6416ec1275dfb3d3785a3d9646fbad4e639c939b0c8c7b08000000000e8000000002000020000000f72d02df77bc7fad2984d873b7685a734524e16292272485ee1c560103adc26e900000005564b2a635dd2f5bbadf86f827fe942d19c203fc0a259d242b0996c2ad2c1c635a87abda8fe5d8885c67320d6774a106cd3a296d7778ba47321677398d5c2f3164de970541cc9fc206369c274962673f3fff1fed3cb06bb1351476b7d2fc8d50a365e01119f7ac443d7f2041c4a74bd83bcb2fb1482c504a9ee14b85a17ae23c506cfd640e2e0d9342dc5beac2757b4a40000000b714eac7978c10d32ae7755600c3d771ce7793579910eaae917d2815eff3b1d2c280f002460dadcf22e33b76e982106ea5b91bff8ad224170d878c91876e922a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2884 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2884 iexplore.exe 2884 iexplore.exe 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2340 2884 iexplore.exe 28 PID 2884 wrote to memory of 2340 2884 iexplore.exe 28 PID 2884 wrote to memory of 2340 2884 iexplore.exe 28 PID 2884 wrote to memory of 2340 2884 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f3d6de0e863fe521a9ade07b74b8ee73_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2340
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ca000c52a2db9c8f43e9c4508890a04
SHA15b87aca3b7971078600170f17082426cce881e71
SHA25668a26e573b93808d2c10e3867efb13c353b2a560d551d26bd4db643e32757618
SHA512fab2c13ba46bd56a1066b76aed1fcfdbc22d14b63b5a34744b4efd4692257eb1565af3d745a0ae35ed4b751810eca0ba9fc90fb93985396656ac96dbb6d685ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db3cce62bd5b891f4d547a18096e3d47
SHA1803a57663c1d7add84ad1e37505f0cfb476d70f6
SHA256710b1a04b0ba6e9183e5f84ac88cacd5e85d3a34544c8b43632a6314364284b8
SHA51219b2275ee031fbff463c4a08790a688d1a8ded1ee85baadeb7f43bb1b1a3ee49f0287ab48f6f3c4c0e7214c4292960d5acbc0176ea861c4d65a6a10a87b8d5c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8b693d030de0e1b3614388d891606b2
SHA122deada61de6d7f0ddd8f4089748d701b659165b
SHA2561861684936bb8875a46bed2f4273fa3748f1219fe2e57f3418575cf182ba165f
SHA512ad35f3b719d496f073557f3e2d3b5dc38a91647620dc699982d57e9e5c8ca9a41ed00e51753413d0db74ed82ce4165d22ce8e207bfeff1dbb113dae6924a8c5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57889a7c145184bba6efcec9c0736fc18
SHA1f389294509328f683f719f7d2a1b540b68a265ed
SHA2564324181360d1f6db825b4d7dde138ba819ae1179f737fbdab0422827f8938d07
SHA512b575e42af15b823685880a00391924006f2c0dd01b70de7c9d7628c1577208670a40cc4a20304b553c031335ed14fd35d0498945e92b7fa57c0ae3e0cfc20dce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bba941dc7d04dfeb7c86a64ec817295b
SHA1a6da55056c2792e018bcb7f4ca3f8f21e5498491
SHA2560d32da01325c13ab2e8a189cd004460217e4100a0788ccb3cf3db6663c64de12
SHA5124ef74ba19a04f52d9d6e58f73b196240b247bf8977bd4a37b74ee469f841c0c261e9e3bda1b0ef7c9490662b700911d1a6021d8287fb94a01fcc3ed4d18a236f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7aa2c6a02d3df319ec29c9070a3be4f
SHA12e8d851e9e85c146aa0551fa1044339348d8500d
SHA256d637361b9a98a41d6fd413c73eb5865c258bda8e8445e5a4dba9d598846beb7d
SHA512d86480fa7d15de37b54f33b548c74ace3070a70a9ed65682a87ef9bf6070e344decee8837b26ccdd9a179ecebe5df790f8f38ad669aeee4246a4540045c3c62c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558deeb74259bcdaf6e203010f32366c2
SHA1fa14939813246d20fb4699bb0b16401e3653b49f
SHA2565401d1e45ebd177af0c472ead2287244ffe7200b6c12f3992735589c46f0d394
SHA5120b387a8fd68f78f127219807b5c7b00361ce65f9d0d7c8d84f6e5af8f910ed682e7f5e3e3000f45f40224dc99a65afa9c4003599f9359aaed5aa8f704d5b5cfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a380bee25ada12bf8f299f27e6afc092
SHA1b451fcb87c7bd1c34438ab4c46256eefc2086d57
SHA25607e3f4a0078c13624634b6a5e1daa447eb093513f560848ee9aae66107fa4a36
SHA5124d9a585bad572f991a37fb1a55768ec6d259699d459a10cbddaf634a9e9b402acc7e3387da2f28150014371bed1a119c77a97685c07ab2bb7734a707609a94ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52994319a91ebaa54980f00829e6066ae
SHA1a909c7fe439c794b5aa065bbc0eb5def2e6b2a9b
SHA2568519e0fbd90e2557e20a73285113b4f676943d1dfa7b75571d0f4fca1d5abf3d
SHA512997964d9ab506fd5aee8241b7c274cb15130a5a4a7e1c82d5c05929866a6c9237204a8ea34c6941bffb67fb82e346cea7051791bc981b938aed14272fcee795c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5310fe156075b17dab06667af43ba36c9
SHA1f660b4d02ee041e15b213f2b57da46ac26ea06d1
SHA2567a6bd84a67b6b7671775acf8784648fcf4a945c82474b3ef3121b78afc60209a
SHA512b421ed48df686d2924b6e9b368320b54bb8f482b3ae5d7aa29d1f6a7303f8b2e8d48d88af5300393f370a3224866dae094f7f5048bc5df05398064de154119bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56514aab8518eb6eec7d0d0247fd19026
SHA146b2911d3c3209632c59103498ae8c1f2217d819
SHA256699cbeb1412c98b9015b78fbe989e02e3d8376df20bf4bcd8607986e3ba092a5
SHA51269bc995aed8ee251ec76fa9607fe95c5f4bf791dbf96acfd16adb4d21746c0492949a06c5db99bfa3da83da3664e62101f80de7953e2ba364e07bf8d452210cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bec4bc8a752d5a1ce9260b2d0f22e56a
SHA1ec2ecc6f34d9c88eff304b2eab993bfbf1e5162a
SHA256f8300e979a0e40f7266ead658d707152857dd2a63f8ad71af0f64723a2dadfc4
SHA512b0e38af282da9277a21d1f9d44b622aced8edc2cc920796870aff4eaf80f3d64d3e832df823fc1c01f25047fe1b97dba0b9a4f170e94f0d6885d502660ad8fb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8a4a0d7cbf2b56538ee3be874ead6f7
SHA198a625ca7ddd1ec668d0c6e873ddf00fe9ee9313
SHA2567b211071abc938b90991de226320a52693313b86fae727e6ca467ea213460860
SHA512b892ebd59dee143ab31d717df24201ff276fc2165b44279be8dd81a6b9d12cb5cff1e02204c969ee6d00ae46689babb07261c4253ccbfd97db6bce6195905241
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b73716e4bb6a33083a8a20962794a01
SHA1cc9e8e0ceee82b5afb37d64c85b3eb756da2fc07
SHA256c06e87385e361badb7ae1353c07aeefbc25771c84e5cdcfe15e225b5a49480d3
SHA5128934dd74b5120b406a0c5ca0bc1bcfb3e3abd5131695f7c6466fd794ca31566245acf2256c1e317c52c58c581761fb790dcbbe8050602e18b08b3bb51ab7d7ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523bc32e943b4c138d9af5302e492e8f7
SHA1da2844d85dc627af873a396cda492f3755ccb767
SHA2564f8a39473c82ac9fe182696a932e1edab4c73945485e2dde0ea61fe3ff695567
SHA5128521460a9328c66fb4e9534b81e364676d7a4cb5a9d56e8b862799f5a3896c3b6fd06bed6909091173ef701edc8b62004edb873b668bed21a1b5d8b3b60a99d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5487c17256363e074272e766931b67803
SHA1861bde5f84a6b27f668de07bc7b102c94680acc5
SHA256695b44e1ff8638d66f817fe059d9985c13ed462680d3fc308a96955418cd8dd5
SHA512b47c801de0e792c6b8aa26631e5d1385a146964c9f893666a9c1addc35203ee962a5d087b754c398c09a912e918212e31924a82fc595ebd93590091fdc7e5bdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5960abc9986ab6c7e8206e4c7919b3b65
SHA1c7eb78e0236149cbb24f899e6b394403b71438e8
SHA2563e7241603e59cac5c05bce05ac0c9adcf539b4a5f77c30cdebbe950ff876d253
SHA5121144d80b68790de0d211b90604cab7585c7fe8ff6463572285760845bcccf21790a13dd98fe27235d96477d17ee6cf85316490fa7a46126ef87a844dfff4fab9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cfd277fc0a9255596f1c6d6fd75cfbb5
SHA1793661eeb137b7cee45196430498b8abf9b11ec3
SHA25655454fdc607ad183c8fe25377057048f98480a7e0730a865e85520715ec99265
SHA512505f6e0103173cbc975a01e7808cb869e65591b5743a77d9e541333e55f306c101b529d0737d3667e3c62e23b2e6f03e9df22391ab1eda3af4f59850cb474f08
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a