Analysis
-
max time kernel
118s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
26-04-2024 13:41
Static task
static1
Behavioral task
behavioral1
Sample
00e4a93b851a658a17ccb1cdff3f0915_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
00e4a93b851a658a17ccb1cdff3f0915_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
00e4a93b851a658a17ccb1cdff3f0915_JaffaCakes118.html
-
Size
67KB
-
MD5
00e4a93b851a658a17ccb1cdff3f0915
-
SHA1
fb6de45259bac619f663c84c161797bd8e9014ff
-
SHA256
f131586f56581fec15985183323a8489be6d52997c4e3dfbd4d640cbdbf86699
-
SHA512
41235d982502cf7ceb71359e13c19365d1234b653cfd9503f4df590508b4f4dd9392b249af6ec5a3ac80acfad6b82e35869a80d2469949221eb6ff219ae19254
-
SSDEEP
768:JiPgcMiR3sI2PDDnX0g6sfGNxczoTyS1wCZkofyMdtbBnfBgN8/lboi2hcpQFVGo:JVwTzNeD0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1EDB011-03D2-11EF-8547-E6D98B7EB028} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 306f9996df97da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420300787" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000006cd54518e4258afb9123672488f56acacb4318ab1e26f256891275279ef580d000000000e80000000020000200000005e05b3ec0ee96f04c4b3fec94ba6f80578805e486bc01c40d773cdc25ba01ab4200000004fefe5d8231068eaee0edbeacc7455fceb5cb6bea605fd5e9ffaa3120916eaa840000000c71f5d7368b29f7a8ad0e79fdbf1908623d4c498e0cd08fa36439b2e56cc73a062ba604463a1e2fc3bce7216ffe700ae6a6d9d6dd1e45a5483e2982aaa3aaf12 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000012286223ca229a51a4b1e4e0ef450a4c6493986d1bc01a1727889e8c92a98a39000000000e800000000200002000000027ce19d535caa61debd2b7c30cd16de1652f867cd318bab96c507a23dd8868d99000000040bb27724756a43060262de65a1b0b32c5db0a2a0a5f5627785b4f0b757903b83043efae1a7b3696df729913fb652258f49cd5e2c23b58856d9f3af2cc3bdfe2ebf99f476916e73e0ff4bac9ff75aa5e267ef53204f746a29e29a74d18cd4ec5da09371da6e540702c5b3f010ddd2bc77336ab7b0c806e8e253ad73f5260ab8021c071bc27580b06ff2c8f6b2515bcca40000000ecc23dec0de3fd12f22cd077a3ed7ca2e04704d2e5346198023da08d9113c48496863ed2a89485b2671e77e13ae1412973d615519b4a3894554833fd863237c5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2172 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2172 iexplore.exe 2172 iexplore.exe 2156 IEXPLORE.EXE 2156 IEXPLORE.EXE 2156 IEXPLORE.EXE 2156 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2156 2172 iexplore.exe 28 PID 2172 wrote to memory of 2156 2172 iexplore.exe 28 PID 2172 wrote to memory of 2156 2172 iexplore.exe 28 PID 2172 wrote to memory of 2156 2172 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\00e4a93b851a658a17ccb1cdff3f0915_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2156
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52efeba4c1c38adf97c8dd9e23b435a1b
SHA1311d57a640bad102994b230f838bf6732fda0ff2
SHA256af2ed1758ae6fa8a7cf23d6f917056fd48c296b8db38afb3615b82de6a043c7a
SHA512f5b2916cea40f0cdb71c02a754b152d3d50e0a76f7c95f7d1bc8bd54f912763d56432f6fff80693692d37136c1dfb8a30d60581bc31d0c0c5a4c61fbf1230344
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e07a4c3a6b91fd491cd8f964883a782d
SHA15909915fef0b08117b5dfbaa7866b3ec74cc0ce2
SHA256d9f159c3bf1bfde8997f092ae37d2d5ef15b012619780e6140c19c54cd88e8f0
SHA5124f25d5a69c414f5c679ca398b54212e5fff91a45ecb9c488305725ea4aa29d7aeec8a1d82b424d03cdc91c141bc0850cabccc09ca4c11b4bc7928d6f4dcd3f59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567235af0f114fd7aaa9f171115758142
SHA10cc451ed450aa9751bf6a5a1c7f03ca0d682cc7a
SHA2564dbfbeb968cdcac8a2178a6e89148e4e1db8d3aead3a6de138924f4d9980716f
SHA512cc2e070b1e059291928fdc750fdcbf601880ffd30396f46ba76bafca3ad485ffa88c0e0b571c2b071c3b9ddc2dbf0272809beae5c44935ec30c6b5856c0eda32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb6416adead759a4f9b8661d67c422f3
SHA169314deee1418fd76b7a3fd1dd3a5dd82040d5fa
SHA256caccde2aad71e2621634c7f054ffe69fc95e2b6598357cd9bda56a0ce322367c
SHA5124a9e22087460679b68a8f40d39ad1700f6b6bf7ddd1ef351627af9f67be5cd3225a73885a4f42d58b38ab5dd7831155aa48d6ef855058d2b4a67877d91b3d619
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58042f05ae049849ec08a688a268fd2b0
SHA16e863e811d4bed9cf45dc0af4bcf5624490135b9
SHA25672ff9143d6a57e2a87f13bc9c3bcc148d33cc5a3ae3646cbe01927587a836ae4
SHA512ff29338934ec7a959138fa2b466acca80438311f43c5fb86d34c5b30230c0f9221293ea046cdf8ff461ec19cfa34d90791cb2242045466770a4df0b7ffb07ef2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd76c1193d3295b6c7bb4b41fbe3bbcd
SHA12397e06682c25fd6c1b11778cee276f120a0047c
SHA256c770876fcddc4edf10ebd44e06a7b07c9d127530ce3bf38eb6ed9084f282ef1d
SHA512495438f1733134f46b0d74d13b96681cad2847206d1d18176c0f0ecc9065097d8d6d56c22c00716b487601044b2be898c6b993810e2bcef816753e2d703bd169
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572a3f9adf237e66dfb22c700d052152c
SHA1564b2bea19dae1c3c25aa067efbe9b85e29652e5
SHA256e8c87c1c502205fe7ddf8d5b078b109450175eb6a3c34ae61b3b3203595c6692
SHA512346b2626e6103a0ea458dd75bedf7002030dcf02b4ca7d48e390829892c4eb8c1f4c524a796518b7ec06466f7ec41e3bc7922a957587f8d815a40712026d39eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5379e8c95ab231ef9dfb79608c3a88b26
SHA1c87db47d531377106bae0705a08d62baffd69d12
SHA256f42bdbdf214b1bc6b7aa14b41fbdc0e6ffcf2850614b1b719c158b35b7740a25
SHA51222cf15f5f26a74b31929cc7b8fde7abc4ae8e4010a2e9b65f7af77013a00e5b32c3c77e6f157a892820ea3143613eb124d1f5a99b80ef1ec8bafa46030048709
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5825cedf0c804b930c5afcbae93af8ada
SHA197227e3b691a3d23b607622bbd1ba58fc1b7ef53
SHA256ffcb155937a4c4aa288f011d8c1361fac45e4170564243ce58dd35b89348ac0e
SHA5126d855f37572ecc6066cc9c354708bdbcfb6239a67f0a5158cbc2ad4538e6a38e30d102b0bf2634f0a91d87c69f306fbf2dbd902ad2af4f2eee87001b67f37ad4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5088ae6011442e1d4e43dd43a517acffc
SHA1dfb6bc1ce6cb280659895bc840de13afb47677d2
SHA256b6bf841d78343bc5ea5ea08c0f4aa66db15a43dc8025ca63de20802608b1260d
SHA5121827eece66cf0006762123cc327e602f344f73153252fae14717311aecd70e4063ec06ec241832144186d63f44d21d526077c3953e4e707f2216ccf44a0306df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506ac7bf0f76cc53230f45af340b2c4c5
SHA1f5dc7357497ff318244517552ba6c07c23aa0554
SHA256dd751691c5f79c7b93f9d305794c7e43841d1615bc0758d6af40d1544a888958
SHA512f8fed91f29f9f4d06b0126e43c40b8c36e0adad2bfca5c844c37cb1da561edd1e78d487315fd29adbddf301f92dd1f864c17513fde1c07a4b3c2d204889b435f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2cf82fe0107ea40e4dea8096aae867d
SHA1ea5ec13e477822828cd8f8df1cc81b6dd824ebad
SHA25610074466aa61f8fd8f14d75c714e7c6cb8ee165285dc65f38152222805c49740
SHA5122745ce2c5dcfac303317b34a15aaa718c84a805a250a0bfd4e318a7c436a3b8a545f2342aaee470f3375745d7b10743c0d2dd7f0c004ed10ae03a15582d9e94a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cccac92e6877a0db5da20d536981d9a4
SHA1ed29c44536537c0f145726c71f2aa6e8a8bc4b49
SHA2568134ddee2d7ddbeeab66d962aeea6cc3ed0826f58d1bcd3df349e03e7a00a734
SHA512eceff92bd00ea11b6568629bfb3cc2018e0eacfc836ad0cbc2f18abb083d6910a4aebb4e3778890be72386f35df23a1f1623640f53d7c871790c14ce9218e0e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5076b80b2d17eeb18841bfccd141801e5
SHA1d0f71c6168869741837e76f8d9be0d97d32761da
SHA256f0a13227fbeddc8a34cbd31014c425a557299a2a79fba7443166bfa519f8affc
SHA5126bd1446763cf6b5676859ca3fc54e81e94d40558d070050e9c044fcad8430df8b578aee7981884f34257d9c60ad3dce34edf87d0e42969e816b7c5b90a82616b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb4b1a2fe8a6f82465aae6dbf4229216
SHA1102e7ed7d60615d25bad2d1ae93fa3ad083e4e09
SHA2563d10694151428e419ad60fc5caf76d835081ec7258865b68833543300dcc665c
SHA512ce41ac7f4386b8a8899283441d9f8b1ff511bdb6b782be686eb8f07ff58cada3a0b6646347e73bc72b22ecc11f0ed725b1337d87e54b7dccd1e8d325a9902eb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e699fad466050fba8c5335fd83aebacf
SHA1ea3018dbaed66b2a5b6a576ac55b179351601201
SHA2565dee681707053a2f10023f2959af1e952a9f87e6376f7f9d77f79ea0196b950f
SHA512d21573e45c82bd01feb0bf68c34c8b3440bca0ef58e79ac97d6ddae2cfe60a1a1aa62fbb0010778ed2e9d772ebeb85d54586fd269d777bacf23bd82e079c4355
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0a5596d087b5831af79eccbb65978b5
SHA16e5709fb4569207efb72a7bb3b0322596bbdbc7f
SHA256c4c09ba75b27ff651f4c0e34603a7c17b516cad2b0bdc70b01ab2f3bbc95234c
SHA5127eef349cea2a19eb7f40d9fe52b8cccfed02cf5068831c8ad429f5deb22fe85a72490c2d19f7b1b9170ae7faadd5f45f4c751a3f5f52312c6d03a5075e2146b3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a