Analysis
-
max time kernel
118s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 01:40
Static task
static1
Behavioral task
behavioral1
Sample
f939a8b37cabcc9390d5c69a27c814e6_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f939a8b37cabcc9390d5c69a27c814e6_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
f939a8b37cabcc9390d5c69a27c814e6_JaffaCakes118.html
-
Size
12KB
-
MD5
f939a8b37cabcc9390d5c69a27c814e6
-
SHA1
ebfac0f1619f9d4986e0ade6142958a7f53fee91
-
SHA256
54cf67d5332642e398e4eb634e519b2effccc0eab91bf4a456f7241a3135119a
-
SHA512
d11f6efb43f6ea3595541e6dacfc1f0f9baf036901ad90804ad95cf357133da011f6dbd8adf65595a57838dac8dff1cefcd59fffcf94e0ef09e1e0e183ba112b
-
SSDEEP
384:ktrRx64XlTuAZopWu96UoZhbd3Muxn4RP:kZdXlT1op7QXNxn49
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419652733" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6072adb7fa91da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e0000000002000000000010660000000100002000000003ecd1063c442d190b2df3bcdd42d93ec92fba28ba57d4324a0bc97488cd9deb000000000e8000000002000020000000fbc7b66674d53117303a7dc394dffb6f532f5ba3873c75901e44f05f794bd6cf200000000be2fe0fd057f34f052f080cb8aba86b590e7bcab0fd096b0c76dcf766d16fec40000000043f9203c3f696e7150c0ba1fe026f9e16915b21b4c158e80242e351328d7910882bd4a71248c27001aff84398c74994e88cf6f9117a446155880f8b29d3ec17 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E247E8C1-FDED-11EE-9F79-DE62917EBCA6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e0000000002000000000010660000000100002000000075c81e1592a0fbe9f5c55962388fa5b2423be00f199b5df85c090bb73db177c1000000000e80000000020000200000009543dfb27e5e4230d3af50312a3becb5a66bdc11d0c19766750e46db982b5f4990000000907f56e68c38f282a81d82c8f6b57ae7511a489d3320aacfef562b88ca968c86e58e27c7520b4ea26915be43124ee02961e939173d0f2da9aa6cc3395fdd93f5d093028e411a8f07601ad51cdddc40f5b49c50ec02ba153555afc7279208d5f786219be7e3a9c60e4b864229a1faf2bef7b1e8a47acc30b9cffde145dd60d0696b2244e2e7b63e81dafaefe81d1377bc40000000c8f2d1ed9211750c50a639695f60770dee7e82cf70f6816f834c844d1bd7237d5e44cc7d64d9da20460cd8d7c09f70f5de1b24716664fe7235124579837cd4ef iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2128 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2128 iexplore.exe 2128 iexplore.exe 1168 IEXPLORE.EXE 1168 IEXPLORE.EXE 1168 IEXPLORE.EXE 1168 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2128 wrote to memory of 1168 2128 iexplore.exe 28 PID 2128 wrote to memory of 1168 2128 iexplore.exe 28 PID 2128 wrote to memory of 1168 2128 iexplore.exe 28 PID 2128 wrote to memory of 1168 2128 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f939a8b37cabcc9390d5c69a27c814e6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1168
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed418196d12ada043db0abb934219b72
SHA14e0a1db8479435b1d4f4c643fbb9ec2ce30cd105
SHA2560be9b931f90366100563d74f3fb19ee2f5adffaa3723af06d2360910aeb9f9c1
SHA512faf9cf11e81bb73d20a1d6fe6328a9390dbf291e32ef30c5e77ad8325829585e864144f0f9b405d05c8ac611913db734ca799ec15a3b59f387670c5ce384f586
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abebc958b967cb39accaa438b8d0cf42
SHA1ac1393c542ad7bc5950fb694ca2bf2f2b456e4ac
SHA256d15dc353a5b15f9bb25b7bc3a133e6e45eff6502c6577e31485378df9641b74d
SHA512a5c09b7e112aeb1892be1f8a5be8ea1053ef4bc023888598ed749060d2ad463735a36b539850cdbd12c316912e0d2b56ba5770056b1d5d52f15c38b1cd9b9803
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5154a37b08807f02fd1a3f2550257b700
SHA1529ce648460e60f1aaff181d6a41abcceac221c0
SHA256feb7a04a30e0358861e396b1c7962867696881539dfd2f6a5548c001a2085cf5
SHA5128717d5536f8fa4b499934aa81ab0ae8e80520e7a17f74099385553e5b2951afc19deb1ecdb598b6b5e080fa8f01d181667ea9a24ec592e88f3d3941e8128aef4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cdb90906cda7fbe1c255a935813792e5
SHA1b6063b64568e80f7d7168c54a6d8518287705d5a
SHA256fe4bb25eed1add3855416d8416d16376d0887346231c97e606b5825988c91e37
SHA512f83c6ac6deded4be5dd4be21a1f22a5686c9f63c8bc9ee07e9170811e3282f2fa3a18e9e19ed2c3ee531b1feb373044ca25e7bc0ac72917879ea35d0de7d8111
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5597e9001d0fb7953f6bc57b5eff86196
SHA1ba294eb588680acd71852a9c49ce08f576e0f1e4
SHA2561ceb2a9fd644bafcfcb741b130b5520f2fe1ebf253df6399bee64a3dd4f2d704
SHA5120a6c89a1cbe62338ba7f9273059391e9a73e917988b9f19422e2be05892d4c510762931c20ce681482f5397a3430cec38d18ba1d120b62c7c2c8aa446ed2afe1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599749ff3d0170987c114072075af357c
SHA10617346f4f1e14d4582f34e615c0937d34ea12ff
SHA25672370f82d5621066279787356965eca5f4bc03331b3f781f9b56570a09c6558e
SHA512aac71424d933257986afcb6a808c8be2e74dfe443b64b80754969a72e346e3e11777a2df942576fa5e6aca05617af21488f229136656b41d0b1d91a88e58ab28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a95817a88a1c1d22e770444f9cd0e931
SHA1517e5e0c72e8856376fb6f605219fb3fd65805e8
SHA256082bbbdff14641e94e344010d0015ece4252fa0a557e78d6ebaa531cd1e3f171
SHA51296f72e1d59deef10c0fa8fd8112cd6bf6531720e4e845e8fb14bd2feaf18983a2ef73db38dba063c433fc31bdee17b638b4679c991bc333aea49e97f442120b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d078a25b19e9cca7272ea76a348610e
SHA152d9d56ad506afdaf1a430ba06dda0c6ed1abc8d
SHA2563ab12060eea5d68b7c8ae203393cbb3fc1f1c82f3076bddfa588faf4865c49b4
SHA512a5b5638ec48c56eafb4b3362fb6e1b507250374b176aded6c5c780cb6bf2e3a08deb648bd33ea67940277778133e05446cff652df504dc9c2b02a30a126d045b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5ceb5b216ce2fad16e9229d234befd9
SHA19b89927a5e22899785a0550042400c3f95bd0361
SHA2566ddcb6439044b7dcf3c7b350dad9c9e20d89e7602e53f5ebe066289a00ac7d59
SHA51292e9bd04440c3e50f28c2f7b58d755772eebbc93a628f758ddcfe8ca6d815d5ec1de07ce73d82905e343876ca15348e5819d7cfe59c1df675c8b148c610fabeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52939c891bbb9a7203280d82116142d32
SHA1fd292ccb7d17e2f141b58edce671d22d6f910a78
SHA256e12354fa117fdfdb4b4c66bdc633e0e54fba4e7959e834d77b2a5720272dfcf4
SHA51297428c1aa9e563bcdb3d9ec25d9389bd3ddb54b8fd525a6a9e13a2aeecfbf29c3d7c837caf7716b9272d23f2ecff2181d46eae413c516df1db0e1f746a3cc720
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543276753b605ae0b3e5ab1bbb1c0b880
SHA1142937ac56e199114f7c443d3c6833b5c21f5aab
SHA2561526a4476aed66a9d2b500e3052fc6a1e85bbe09c58d63e1538f6603b0a6bf98
SHA512bbfa8161a06dd0748cbebcf69b27ec1ef0e1d889dd1388dea6a1d816489fe8fd0582a53b6538ec14bef12b1d8e9e2528f581a9dd13e9e43258270c7e77b4d209
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f74a8b08a158f713aad1ec033ff08a05
SHA1b0bf7258a0e69b152570cd8ff1f958ae1b626cdc
SHA256909dcf51c41ae50a76cf01b58a3ad5c59b4b1acd0944762cfb5781e6565c922f
SHA512b03905b76a8a50377d0b57789b489e136d9e345f8a97ad3136ca847ed14c6873b85ed80be99e52b24d19c77e4505ccf60b7bc3e0922b70a4457a8bb4f05a790c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5153c9b92d86a0e7eef3242efef046dee
SHA1075c82074945f82f8bc601294a88d8ca60fc5d6e
SHA2564863108c0b74e4f6917a8fe6aebcb5cf65df64657d2f8fdd56c9d2c3be2821bb
SHA5125d137afbb54846564a02796d17b48a030680fdf8cc1304a4edd5166ac20a1f26694d8ada5faa6fda371c166e5e71c0ee40e955069ef5a0dbaa4ec0b933981cfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5201eb7ffec091fbd2ebe964a801a8a79
SHA1f5267181336b39d4caadc4d2f53951671cfcf0d2
SHA2564f478d7a8c6003e93b360badca6d3099eda5d8652a323f8bf5a09b2f1a856467
SHA512169e8f8d67cc2f8dc0ff6166d8129e02bef32d58034f340a8dafc427d0008dc4c326b382c6e467bc541faf8ab43ca2be1435e4b81f7e531f12b3e8610aae2dce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53480905204de4e7498b2902d0c270040
SHA185246bf3ca516aaa90f056549cfef62703ac6029
SHA25613421471db360651a108a20da6c61c5f8efb0aa571c498a039f4773f98c30029
SHA5123ad76405a07af632ecf10d7e0588d5feb0a2e55da1365f02602ba33de643a6413d623665b7e42c830bdaddbacd8c28b512b3ef1420c0fcf27534ce8bbfb9fa08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3f9be22af5c0dcbfdd7f20bb239deda
SHA1af9e07173894445ee7ebd63f00c57ef467c28532
SHA2561da64a81a5808b6f129d4c2c948e56e1e2197ac331d4a154776553a936033a34
SHA51200ad0ad2957a782272aab88df059018a7e4bc45ab97c2f4fec5190b1ef56b039773bdb774c703aaf728058598b2ae162cc29899f73e75bd61e8bd835d3d9ee23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5796494567cb6c391bc5e004b3de0c600
SHA15c9f1d4b1ae336c0e162f5de31120a5bcddb60c7
SHA2561ec6d8fa63b62b483451829f3d8ffecfd788dfd950fb84d0d68b998d5a61293d
SHA512f522b2b7bc6524b07513a527a2f5040399bd369fea847ec3906c95d208de0d04743294f01faffb436498b3cec53ebdf165795d374e722e266380c1955cd1a991
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2192eadb38b01379aefa20711a75a6c
SHA1889c6f69c2f8f65cd031fc0f18445f566b8f5da2
SHA256b77545bf58766a170016f491ba24d39236446ae3df8bac98118cff2327901de7
SHA5121ab45a6868cf5256e81cb472263631a6cbbe1bba7e16a263274a6e420d59d72e4b86251cc899ae861c4bbfbc7745a6aaf70ab7f88e4fce899703d78139e3bc7f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a