Analysis
-
max time kernel
119s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
17/04/2024, 18:51
Static task
static1
Behavioral task
behavioral1
Sample
f670f903d551fe6022fcbaaece5987ec_JaffaCakes118.html
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
f670f903d551fe6022fcbaaece5987ec_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
f670f903d551fe6022fcbaaece5987ec_JaffaCakes118.html
-
Size
23KB
-
MD5
f670f903d551fe6022fcbaaece5987ec
-
SHA1
28c5e43be6904f2df8af4f53cf8aa1e302310997
-
SHA256
da67d06d1c51bab7bd39ccc2d6b5ded52964acd0c472705ee4550613c1918c09
-
SHA512
10d11d435520c50e71c598e4de599999e31cd14922943c86369049376d2bfbc448ccf4102c432f4f39f59d261445ed3b30281c83a7629037d431d62a3cad6cc0
-
SSDEEP
384:Q2nA4yw9h6pzSmmztvukeKXXTuiw3JStj0vKL24UTpNyOcn8tvG5nTDuU5esT8a:Z1nhdtWkekpEsAKc7wV
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b200000000020000000000106600000001000020000000ccb8119fbd8cd33bc4abdbaf86cd7fed6675ab6d227fccdbf42f03bb28da29db000000000e8000000002000020000000fb40ec547adf0952c191661dd873b2e175d6b14256fef231bb656f820b733985900000004d94e38b4d122a69fef1b3ef5a2611ac8e5d63af587a987b9c54876caffc7867c033a38bd52436f54e2a6a641789b8603f83c0292c2ad06036d7eff5318c0b363d8c9f0611243ffa6763d3d1afdbf4508d83329bbb98a128570544fc88db473c1b02d9c75014a3f37b3f69b8db3d7b30ac08586b0496eb322b32b40084cee50dc060193ebca2e5f60865be7770f0e87b400000009de0aa8a92574e232e36afe5a540da64ceb61f5397fc2e6d638024b99fd0bafc593972623e214e1a6e84d3239012b76d920b5dfab24b7e88ea76d9d49374022a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419541793" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{914B10D1-FCEB-11EE-BF31-5645FC2EE091} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b2000000000200000000001066000000010000200000004adc1132b622c58460ed935cb7bafe6c584e75193ec9e3d0c200a89faa6ee206000000000e8000000002000020000000aa6bee81934f3fa27ff290f60a7fd5999b539fb0e7da027fdb78855ad7a88b4520000000f5d0b7187d807d63b8e7a1f801ddf16da773a124c9590fc65340e5d716112e6940000000e41b06bb78adfb9d2923d024e75e9f66ffa622112189623ab3400d8202fe468dbacbd9fa7024107bf079f63d563a79a66c622a10c5845d452adf340e76e8de2f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0fc9d66f890da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2004 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2004 iexplore.exe 2004 iexplore.exe 2212 IEXPLORE.EXE 2212 IEXPLORE.EXE 2212 IEXPLORE.EXE 2212 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2004 wrote to memory of 2212 2004 iexplore.exe 28 PID 2004 wrote to memory of 2212 2004 iexplore.exe 28 PID 2004 wrote to memory of 2212 2004 iexplore.exe 28 PID 2004 wrote to memory of 2212 2004 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f670f903d551fe6022fcbaaece5987ec_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2212
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d93e79fd479c1927daffc8f7585e3f9
SHA1089dcae3642b766ee655e846626f6e7f5a78576f
SHA2567a957bea75830a832ae4b6d03053586c28403d3565e46929f97a8734c458a820
SHA512fb1081468bb08c95279dc9bf8fc5461864699d2524ced49e5e884152f4450c30d208ddf8751c3f92c768037023f7543517d29ce6afaadc4cd4dbe8790222164a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db7aa0610f54baf03fd69f8f1b3221bc
SHA1d8fab5b22bf28632bb8511803fe9345585c7d743
SHA256d78e4ec75aa6854d6baf5b1a96b9738634d552d3f41bf95613de870e64d8faa8
SHA512be588ffcae7e6de6e88adc73afce5a98c290d689790df836dd2f3d359d1002937e2e6c35bddde9a4a430df316cd49d430f33acf5f521df8841ee4dc6d96627ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e5777a65abb168965e9a9619dbdb5d7
SHA1f530b1ad55f916edb28665bd690fa6aff45438e7
SHA25698d68968c55eb796013fa741e1604b578f7756f4dc585e7acfb98f0317aef78c
SHA5127cf18a58a02cfde65f2c92fe8aa28657704b35c639ae0e70d15757632d1291166e070613ad99bacc22ddac5b61c15cb82f96ff9a481f5f3035c213cbc644848c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ace60c28b8902eadf4b242418446995f
SHA1c50067e5321268c378fcc641cead43e4b8383c8e
SHA256bb27ceb2582ac2d8498a106e0f5e869cf9103c58b044ac3d0bebe4fc44219d31
SHA5126a5ec4bec5a73dcac7d96473ced124f2ed2317fa9f2a272b32957704fa43b98c2504c6eebd46d034fe4975d6b809c94a177f168bad4b6ce1fbf7d76b89ca8cd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e5694d7e5b02b30059a134fa39f0b26
SHA18b51d9c6b92998c78126e6d536b0003e15ee7e55
SHA2569ceb0ab318d42cd08d7aaff2eb88c75b3ef3e4770b8912bce0f8393783e8ad7b
SHA512d6b771a774cfb39c1f50ddcf3d8f4bb3a96381922b56657338d3b33fed14349e10bb5eb270b9dc0cddcb3d9189be1a9601052aca25b9e6e49a79c998c9ff1050
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567c174423ecc09b0b62eeaed4659b4ef
SHA1d2f7a119ebdb960df8cd1c6d229b8433da372444
SHA2565cbcce0ee5790a6c2d5a7fa6ee81d0221f973a7e6d8b33aa5f4ccb4be6670ba4
SHA512d922256352a90cf2df1e93f17f373cb12459a07ff08e4746538f1346e80de3a1907a0239e8725deef82e358df1341b2c1ef8511aa9d70bbf5be9be2245f4d7b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ffa7ab0fc9f6f246dcdef6a74a160308
SHA1b6a26c90dbaebb21e4447385e7276e9c7e34ca65
SHA2566cd6cf7a982808110001d01ea8266fa8789fd65a360f0a53b6ca1690a8a6d9be
SHA512cc7478959842ac6954325799aa666aba399dac9e1b8afabc4402c1c4ad37fb1bfab899fdc4958ab765313d924e7a3212afab29ad54c15a0baf585e025210dd18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5545d110fc0ad4f955963e830a2132ad0
SHA1764cd610de79ca3c5421b59ef7ea116dc0610181
SHA256112b755581536ba59703443189d488cf680ebd9c6a5a9b3d0c5567a99f2828a0
SHA5121274233dd0ea1ea73164c2ca81dc15f0b83036a600a75e76fdf037aa5108e1e5319ad0e24c997d169b971bb6d9b25a6b1697abd6cd144464ae8ce190c8e651f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53365db807e18439b459ae6bf3faa621c
SHA1b1f5d20da34028d366bf9649ab198c142c5323fe
SHA2566d16d410a9afdb5bad5ec395f4564e3180d2a4eae15c646af2cea323d06ac469
SHA512ffe2764e8ab4ecb6ca3d3674b296bd34053abc8061d12ba7b198659330432458ece03e55102df3ac2bc27e87ad58a17efdb7a2d13f5eb737d9b59fdf5e704a20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e53984ffa7d60f01f904239a06abb2f5
SHA10316511f84f1b6dae6adc4602d87577d5c124194
SHA256b9b7ad50868299cf731fc0d7e7afbfc21193e2f1961d46f743517fe8aff3a71f
SHA512bfe1f6a830f4f5069821ac8a824acce020a765f3898976a04c4ba9281745edfecd93eb2c0631a0088cd711595af72c0f4dcba9be0f5e4587b340699e7e5ce572
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54151b562443b5b92987ddc9b49e5b32a
SHA1bebbd208ce1092fee9614db57c1e75db164a7e67
SHA256758e63005aff7eb5c7a4b7bcabcec4e7216b79fcf99905b1a2c110fb8f85ac98
SHA5129aeee464570688b79a15b02157c713158a05efeb437f270c343f5b9f9c6ec6d92a8c7f310aeb6871ca332bcae9070c92066525bbaf7cd59f958debd458421d93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c7903e362030231eb1dacd1a1400682
SHA11046d780736f5a0b2e8c0689462bb7ee71d57001
SHA256b937b488afdf06c46edff9613170fba7716aabd53fee089bd54233471779c5e8
SHA512b5c90b75be78d6f86192681907f32e40a194dc5b6d83fd2aea37fe40d1b0f3476fa47fe788bcf6fb0b8444f6e36996d8b7044de8d01faf48fd82aba16430c95e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539a35309664b1f913f82accab4dfd41e
SHA156b0e0c87beb0c568e67719abfb02eb14eadf754
SHA25646a72196266a8295af20787dba6955c46ef3eec59d6f2318e698cc3fd6213224
SHA51282e64875df7dfea72b2737ab3442a1f1bd1ded90573101e68434b7795f76b49e93d202adc7a35d764b7ffd80c844f881d96df5d39960196f6d4412c83e5930d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51080792a594d497fc7ab747facb2839b
SHA10a030a271ddd474526b8845e5e1354f7513b3692
SHA256aadeb4a70854278534461472b1c4b4de0bb352ebc290fa0439037f0a37a6efb7
SHA5120c5afe4796549265d4b9264adbfeb059e602bee450d2d8d3d01a74b16dd1e95bdac52ed703e760447449177393d35d50f363a58a9c721363273b45c0450a06fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5577acd10c8f4d06d84f24c468f900a6a
SHA15e7194e92170eac23a2592f587b1d5cb830eae56
SHA2564df6c93b6091d85b38796f869a97cbfc22a0d393ee3312b2e36196c9cb3ad3cd
SHA5128a7502864d6f26bf13c27946270bff030098219aeb2089868c82fc03a7fe763368e832fbbcc499fca3f6eeee170355a121babac4cc9fe760dc548ed17c26d058
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543acd74f940170cd768b8786722c42fe
SHA1daf16cb11022af921c1d844351cdfcb1f0ce21a5
SHA256b46a16fbc752a4f8943c679bcbaffdf04ec4c50e43be79505336fa9cba7c7b70
SHA512ba962a69adeb343b4343ffd6e6db1ae0b4fd8e17d67da20862b31734cbd2f71b8c97e8e54dee374b06122b62b4babd31ff12c5a2273d0d2851f38a35ba49dac8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533434aecbeaeb4b7ad87045eea3a1d55
SHA18809d670474f4a036f2e43c40b44b8151ea89b75
SHA2565243b5fcd637b56d6916139d6c93e58e6fce168cf7c3ec0fb3bca941c477db8e
SHA5124088adecc6b7c75b1562946c028b795f70f4e2cae0109459d27eaa1ad8e503a7ee7ea2f85b9e31fa82b0aacc0f46504b403232aa6309f36be3ed2ac560474109
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566126c699e709faaf65dc26f7b340854
SHA11f7eb05e6168b9124acd8384440745a2c8af00ee
SHA256c4742ed22b1b9a18c18bf658936d2422ba2bce92d0272da6345d475f1e3337ff
SHA512170767cd513c258d28fe88b2a582ade62f7ab9c99c1df1cfc9fe017f168108d6bb349cc76380a20bb405a1902d2e288871bf209c8e37d0f97a7abb2bc733b55c
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a