Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-04-2024 17:18
Static task
static1
Behavioral task
behavioral1
Sample
0144a06daedcb21dbc2352e9bdecf935_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0144a06daedcb21dbc2352e9bdecf935_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
0144a06daedcb21dbc2352e9bdecf935_JaffaCakes118.html
-
Size
141KB
-
MD5
0144a06daedcb21dbc2352e9bdecf935
-
SHA1
7ac48ea16b55c148575de3b5200ca3f823159a97
-
SHA256
d56e3f10522aa241e53be444844f91bf32bfb6178f1c9f4d36f52555e9cef60d
-
SHA512
0a5e8d982d29343dcaa390169efbec3b315e611b6aeace569415571750aa762d023934a9b52ff17d8ab41eb5342c7dba10b35b8a3cbafe2af34708dd2879fece
-
SSDEEP
3072:SbWArBx7dyfkMY+BES09JXAnyrZalI+YQ:SbWArBx7osMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420313779" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01289831-03F1-11EF-9CEF-E299A69EE862} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2756 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2756 iexplore.exe 2756 iexplore.exe 1816 IEXPLORE.EXE 1816 IEXPLORE.EXE 1816 IEXPLORE.EXE 1816 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2756 wrote to memory of 1816 2756 iexplore.exe 28 PID 2756 wrote to memory of 1816 2756 iexplore.exe 28 PID 2756 wrote to memory of 1816 2756 iexplore.exe 28 PID 2756 wrote to memory of 1816 2756 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0144a06daedcb21dbc2352e9bdecf935_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2756 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1816
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d37fe95240c66aee8a77cd934c5c3cb
SHA1901f970ed4007bcab767ce9b33f49c4bcda9e32a
SHA2565bfe42d57b50d1cb804a5bef9a9173d635cef8adbc2bfcce6b780456b1a3e105
SHA512ab9bc329a6273ff645e0bb0af2ee0377920729f0e1a0e02da2ddf290211805f0543d1cdaa66c1b60639440adaebe049b847d4febc5c521d75e2de94581c8925d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54db8be9ee5ab8c24a30a576a9d2c71f2
SHA135f4ad98024362a0063878c405656119f7dc3993
SHA256b05115d7548b0163780f652b3d0f3d7df04483ec62aa02335b76e1773188bca5
SHA512ea287c757055e53605072da41823f99d736d5c97ed1f08126ffaf03181be0acd7e4356daa3d412444c2042f52ddbba53e25dcd03f5c31b30c9d5f56936833bb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53eea44c1a65c5dacccfdd610baedb947
SHA1c16f8a4607838bc4269bd601d8cbf81cbb6c2ed3
SHA25646ca8797024cdad43e5ee08b86e749f2119f54c912e114167fa44e79ad2975d9
SHA512b76b8c57b7d0e84389bb1d9b8fb89bd46844b8f893fa58c2e0a103282d82bf7a98ed9bbb01888cc727c9fd53183678be4bd87ac5c079e74bfd007be0230c7696
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f796b1a62d8e5075bb2a7578c17c321
SHA1a8d492bcaf65df25de656bcad2c1d6d9a8d221fa
SHA2564c0eed26fd1dc5888e0598a1ce1fc1489bfc3e825f62a272fc74d54f5633232c
SHA512e8567c20e7c88077de11de8cb91bbaf87879f57c34055ce584134a6107cb2ea553ef54a47746ae5865ba1806af62118958da6fb4d24bd7f6bd9317e9017f2ff7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55066c300f178c58a7e499703af0bb6c2
SHA1dcf7fd155b15e0209f00e1de960a3d6a30dd3013
SHA2564366131ef005fc48519e7660be296860275c086afbb0a9eed9eabb183a10301c
SHA51287a190d95cb0d6a4ddee764c2014bec5e6af0c186f835df980268bf7b13212ec4eeb3100be810f2311cd57051c239e2d0cc836906c1040d31000ed5c493b4d5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54207ac99962088261f454a04d07417c7
SHA172e63a3f968b6f5f4ecf275e6cb32edef531a3c7
SHA256e79fd9193aebb60e92eb7ef4b3cc4938bd71c2ec360e861ad8df7d3ae185b0cc
SHA512dcf9814e8776143d15af442208e009a2e6578da5b1cfdea975ebf78669c9dad0c76521b6bd4e1869b5f6286b25b1a10fb791e91b7115deb0fca3bfd7299f5aab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569d0acabf12c26cc301a632cd9274dee
SHA1f511aa1d2c02152c31cef8876d933740ab31164e
SHA256351d66ae28d8a293e6c69e148600ff5182b1114a7434d57258dc856103590547
SHA51200cede4f91f4347fea20dff2d2aa568af1dde4092105b6373dd149f3c371d135d76ac86e2f137b0e9b0fec39da128a3a6af328d7232c4c7335cb5c62258e01fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d31bd5404d223ff115caa7838f6f8f66
SHA1e9f8c93b4203f86516e95c550df6fdb3850c4943
SHA256f7d648ff200fddd86cb5e1695b83afa253d454fd8736534e1be7ff654a4869d4
SHA512942be39f655f3f96fe0df31ae997d35def84ed935e476623dee50bd1431bd1dd9e1d9cec7199f968bee60f1345fda01dd2fb5035672a729420988ac6a392278a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d659688a0fbc598ba64f3fc23d0d1b27
SHA124c15bd2c09e8b5fcb4974515ac64b6d08a4f407
SHA256493f4281fc94373e1c424af08491dbce3aa0d8284c89c4b9945e90ba18afa305
SHA51239d2a1a9cbb45bc0f696ed4b02b9596be2ebd22c82c94e2acf63f070193271aa350bba2e65e4fbf58429b39e8565dd514911df2808e8eba8e749d981369b98dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd0a4807ba0bd7aab57f871a26b304ac
SHA1ed6a506ff3ec9a7f17a82222d04808b07ed46a33
SHA2564eeec820366e86dc2fca1cf0bb8ecf82cdcd9a52045c7a94b14fba75bedee05d
SHA512eb5451651fd88b099fb4128411ecca3f73ddf26276b867b357941ee64ff56ba10f7743c5443d2aae5788f0b2349a1a1b52d160cfed96e99915e5bcc9c0419197
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0907005c1e88d34ac789812cbe46dfb
SHA12375b4a67fbcbdaea2f28cb0226f394f7ece76d9
SHA256ba79d2bb6ba1ad3b1e4b964d6b74494195fb62652b63affc5772aef0d7bfbb88
SHA5126c7c09ab1d5baf452eb3a583829a0cf0a7f3bca6f7664ec8ff368672f60a5df1f3ffb35f8a15df0c8bd5d16fa59e0b47730868b10eab55a93cb5acec3bd6f64c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c47095a287daad94f256c9e60bc059cf
SHA18472fc29301625ff9c952a2c3d5d7a901fa7cdd6
SHA2569729f9d866835ab714e168fdda73ad036ce083decbb93a5ab19b036d712cef1a
SHA51258580da44548b318dfcd2ffaaf543286fc147d675858050d76d4a8efda652fc637d02f471c361dc9a6533beb75ddfb3ba1021a8ff806549998515f50f6af2bf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6201f97b0644f65d74df1a559cddefd
SHA18e090100a919b85b84d355e85bd3d63656dc285e
SHA2563be3512305bb4a9515f3fd945f4b74255910935c78923f9bd0a4e3d58bbf7fff
SHA512e2bd21f1f83540cd47fec21d1cecc048fcf1760a230f4739308766a263d8cbcded7a916af3304519e1d4757219bcce5ef64ab3b4f6234c738fa3bdf6e48ba5de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5507ad98c79bf6b9c65dda6750600aa27
SHA19d48a7142cc2204d5fec762cf933a731da716e39
SHA25656972e2c9f8d829d4ab802005140d1a7c8557609ee3c88e3b2b1b08fa11a0ea1
SHA5125feb693806c324f68826fa4d8d8e1662a5fc74ad80a573385bebee23b2148489c26dc35cf5eedc218911af771537b6f0703d22520c1df0030f63d45dd6c78c60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e620bad144956a58c6c9aad48a2fbb3
SHA14f133926ca2bebe2b5215b5f3db36dd6e8012832
SHA256169cb446943bb5e6e23a38a710bf226ae41976abcd218aa62c4170373281c827
SHA5125ee9df5e90d8dbc6088e2716175c43ff14d54260842e2034fb364df6927cb2b9f4e5129e56e070ed023ea24d618e8ce29c514963a95e1cc21373313c4064eff9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cc9017082e5648961e56cf69b5121b0
SHA16512cb02a3effb813f9920c009f6d36e2919bb5e
SHA256bc5e2e051ef938b15d93f85cba4586f835e07a81f944d6679945967ee3b74861
SHA5125fe64d419fbf3ca00c81db4aa36f75900750139b4c8139f153d6430771663bdb5710bc75cfa528ae5c91820e86053181680fa709c07a73565b1aabebc526f18c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ddf3cbdb61bcb9a8f865f7e16e2151b3
SHA1ce845c477c966e7f7e32bcd06c8088ba4af1dfe7
SHA25641ba76b4a2af6343014f74869d586afb97f41a46b27f567f8545c0d223eea4c7
SHA512babb57d7b3b78d165f7f123222650b24f06e486d3897ed525d659fc5869676e77fead5f6c37afbd9055f52e946fe3055c939d8799a4d0bf3669609858c505670
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8545bbc8d88710f33a5ee5ce016a056
SHA1b4fbdc1b85c1879a25b49f8d1768d36acc45015e
SHA256b3b10f1b822a56dd9ed05b1471728879fc5fb93c1f7379039c410b9290b167cc
SHA512105e215524a44991201963ed78ac1bb967c452c850deb3ccb9b385a8bb756fe0184a12e814bd905bc7d4d20aa5d4933ae0438791916ac76e1722531a671ab236
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59458e58f00080bcaec449dedec44b27a
SHA1a41b36eae0b8420ac45a052dfe7e26fbf0514f5f
SHA256e2f36fc065a65c6fb879369a25c94775f0f3f7f29e8293ddcfca7221d43b1f20
SHA5126b77612cf4b3a3cc212799c7cf666c1ba81c0e654b15b0323fabf02425a182e29dd6c66d187d1067496f9868481672c34189dafdff564fc153da52c7f00f0f83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5faba0718b9e4396609c97a141b3f8169
SHA1d5517d959daa5a4e334f0a88e4833da320392ea0
SHA256f723347db2cbac36057853f867de8f8239080153b5a018e89aadedcf9e2c98c5
SHA512138b4fd51d6325aefc10c3c4323b9e6a462b8c134bf65d728f3610b26ba0b0b9af747361299463c5e2979e16404a3a12ad1978aadb7c6dbabad930ef6c8fa0a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d68345383a1d903504f59d25875af36b
SHA19b91320ae8760c30fe0fb8060e7775c89250a58e
SHA256450da2cc56cebe942883ceb4d1b1cac6233cfe31e8ce38e107dd6aaeeff16bd5
SHA5120d5ff8b2fe7a405b2e39724fa12d09cb79b0c3d8808abf0cd1506a51b1f364bda5cb4d6acf06a946cf0c300868b170170bf75fdedb9b4da0f292383aa0881b42
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a