Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 18:45
Static task
static1
Behavioral task
behavioral1
Sample
016b77e04e6df5f23408f6136ffdc9af_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
016b77e04e6df5f23408f6136ffdc9af_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
016b77e04e6df5f23408f6136ffdc9af_JaffaCakes118.html
-
Size
12KB
-
MD5
016b77e04e6df5f23408f6136ffdc9af
-
SHA1
b25a2fd0af00b75897a8e7cc336ceac5720c2373
-
SHA256
dd6ef32e2e3c3bb83295236c17fd8cfb7e8c1250f94871a00e3d99dee2292b30
-
SHA512
bb8e13ce85a2b411c2ab31043c9bf2698f6cdb6124725aa5d4e1c0d6354acecdff896eb439c9566b0b610acd75e03bfbcd15582fa9aaf1a079f06f18593401c0
-
SSDEEP
192:CyiRNOXDbQLd6Dd5a9uvS/wQFCVCfBHV/06Mx2V1bovNU4MsZ8tjYP:CyiR0+A57FQFAiB1/06Mx2PbCU43Kc
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7094fe000a98da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420319005" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000001047c5a2c44b62e5be909580ad98904e643028a0d864e7a02311f9d68617bff7000000000e8000000002000020000000fbb9245d587f414ffb3873515e5e3a70d5168cfb126dea6c87cd932b7ee64cba900000000266faea1c79da7572c69b5f3f7c2882b5acb23e2ce536b7e07ac433917c80333e1d26ad4b75f0e8fc02adc2d7bc631ff7581d28abb12375e286ba1aee3bf0e06c5f4d63c57a8260856d1eae7be901ad8d4a49f437bd1e5313a569df30a6c12624191169ad18f24f34c19519a45502974713b342aec8284ced63ee56d18277717073dc51d5a6deb2c5fe6568bf315da9400000007ee4d0c1aba8993e75bb79e3f62381bbb116084668f6fbe85252853013ba28928a7da7c5ed4b0823d3cd490875a948a467a7c4f86a7af140bb21188116fa796d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C3F8401-03FD-11EF-8FBA-CEEE273A2359} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000003f806af1aa2a7059c8a6e7107f0fe9b2fb69f068694d79adbb638479f67b122e000000000e8000000002000020000000a78936537ba5a95868c8f026ce2632c904bff6286fc9babf00e1c10267d3ff2f20000000a0671c28a5d74a34a2b452853ba95c2bfab5f37996d0783c2485d17c3b17645d400000007eff393aabd1230cb67aab581099a5521d7179b69e6ab35114ab62be2cabf59b724b926bc6c181660648e4296b47df3f37c61e235c7dfe25fd0458bbabe36084 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2436 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2436 iexplore.exe 2436 iexplore.exe 2912 IEXPLORE.EXE 2912 IEXPLORE.EXE 2912 IEXPLORE.EXE 2912 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2436 wrote to memory of 2912 2436 iexplore.exe 28 PID 2436 wrote to memory of 2912 2436 iexplore.exe 28 PID 2436 wrote to memory of 2912 2436 iexplore.exe 28 PID 2436 wrote to memory of 2912 2436 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\016b77e04e6df5f23408f6136ffdc9af_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2912
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f47794dfe14908ceac7ead48a22ef27f
SHA167af8a6f63d0b71e5885a2de730a7823551fbbf6
SHA2561e66eb0e61714a1dd68965949238a26c8a7e5e9a2727d77cea7e66cb2f8454b8
SHA512ef8e9e6f17b6a07b2e5925e16e502e36849b057b948e8d9640205c7190faacd6cb4cc84b2538146891c99be1c3e8650c84d0d646d4ecc49b22483845c4f84a8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2d5e953162256f1feb6328ce844ab69
SHA157879eb902899199684440c6613954674a19a949
SHA25697d6e274fdcb84eec114ad66117f036c330b1157dd3a938207044d17262b8c72
SHA51295ace882f663a9f390ffa92f680de8dd82c4bcf0189e6f647e26e0c0b0d70d3afa95c1830082bc46e87276f07f74d96ee535d82998bff70bb880d6b5c75d3b79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1c3817afad972ee3904d60918e8af74
SHA10cc30b0ebda696cf8ca1edc556fdfb2ffea5e3de
SHA25670f8262863006e8f612efa028377d0ac5eec2b52f4c30220e7b85ada4d05233f
SHA51268f89809dd8449e2526b3f3a57269c97fb71e9642817f2921f31ce3f32916c86a205a013023a8a2ef274a75da316245f84b70008a57519cafaee4af639d0c2a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5030593b9bdd34ee76cd13dd32611b613
SHA12f1ccea2023589731d48798dc7adbe64b1c9f761
SHA256385cc867c4389271a3f717d1701c0da289ac78714663b6579f21cca75b3ed008
SHA51217629864701e0e485ab7fcab4aeefe6755e7423d285906bc6aa3828bfd0aca30b2b6bd5da58fa35ce3a0a8d99c245bae0a90ff614fc948f7095bcb9fd34d23ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7fb6d0cb10acdbe7b1595733f00a455
SHA1ab3eaf8c75f7e05de359149c5acb0745a2ef08a2
SHA256b996446166d0aabc9dfa166e752f1a3dcc7eac57acbe3981e5fd89a6d984442c
SHA512d0ed5ee8011ec67120ea43fc29aed8bf8b051e9b82676757aa5c72f0c0343712a7a9d799c9b8e1d9fbc67a39824bc399ed182bd579a9021635e6b972149deb80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54df3ef08df1de79bc6d38dfb1eb44370
SHA15a73658aa908b5b03eed1916dbe94ae2940e8833
SHA2564912058030da0708915121f992ba8e7e35852bd4517278a9eea280660d1c90ef
SHA512f3c63bf45f7b1e452c26219e04b7ed11cf022441380237a08752605ab2d323d0acafde280176e7ea0cb5ae50a6e43e505cb83fe6f7103ae742508660cbfcb960
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb6099d4b04fe4a31fe5c01fd2c5420c
SHA192abad91a49cdfb8868c57ad48c81d8dd89ee8fb
SHA2569aa358b7155e56611dc1ca054aa42696286e0ceb41e18e4fc7379b4edf9d29c5
SHA512c06ea27e5be8bd067f6a54817ebfa52e7a7bd38db8ea3ac8c0321bd091c2e5a51e4c1a167b5aa7957c59df8931390c9e1095a814a9fa02c49a84176cdf8f689d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5205e4917c1318eb2d0b6f3252f405176
SHA132c6705ab8c227a6d9c1ae4201cac144f3870c5a
SHA2560a1ee16cfeaf6e22ffac633e909d319b4c68815c6355060528f994927a016718
SHA512827c10941c4741110e7f7168c889cb6c1cf4eabd827c0f881e6c81e918a5add813eebe8499de4dd95d4d2be64a47fa8cf158558a11a9d8a0f7204f0c4cb729d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1a9aa6435d06bf3b52ff7ba4da7c872
SHA12ec2df82b1372d625c2666d116605dac14a3405d
SHA2565663ba901fcea4872cfe7849939abec379470758d0ffe64f61688ad35a2d3b5e
SHA512c012f0697c7ea396738a19e6c8f367ca399602b8b8ed7a8df9d2350aabc2bfb0bb9c72420a07f78cd6a8eeb64585b8d569885a1353bf4f671ebb75e107ecfb5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f85dbed9a10c0ddb156f095f83c33fe5
SHA1637fb56537bf38fef344f54226e4c2c535013bdd
SHA256c820e89ae641d681ae47da2d849a2ef65df6da01ddd45b8d0a484863396e5b2a
SHA5123c8d8f9d26e948ee7fe67806421701fa704a2028169963ea12adb28c4a8b2fd9c70c858d16d1c52fd11b18964ead5450c5d79aa430b4e74d59470178fa582736
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e98c699c2f10be7c4a0cc1064ca7aaa
SHA16879ce04964f27329df6e27c05721692f68b8def
SHA25628b427b3f336b6f24b6e3bafaa69cb0808f6ebdd4a3c8aa7f46f5ede60da2053
SHA5123c4cff0241aca96a9fe4135c1f1f2c6ed5f17cb5085db6786b0894e6c6358303a00eeb6195dfca5ed586ba30cc1e05c2b23c0941af2e5ffbaeb93a0c0b32a44c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527a0dd70a441c75cbf064a0411eaea9c
SHA1a580654bb1614948389363f673a24d13aa3f8a78
SHA256e0015d4e58c80cda82423d4a76933077efa6d3d7b002da483b9349df79a22740
SHA512b506842d28b0a99f3bbebc22061dee33ab0324e0f412d2d30405a65838cd933ab7679e5a0e9d04318dcbf6fd746292b8749f26aeae57630ce4a6746080ab8aa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b14d9c473a0bc11aad816eca86148f9f
SHA1cd8297b5edf18164c875b999e5f643088770af1c
SHA25673964ef1d112e759230190561b0477feb037708f2d48a8925e8ff118964b3b80
SHA51221cd48f263a4f140adf0f9a6724ab181aaa50ce592c1f4572a1ac7a9a09d868f347d59229631760bff90de8ea1c7b558f9a323f7983d4f149c9cf833d333de18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9fa02a156c400e8e05f1cbf6055444a
SHA1419c5e04b8bc9691987e139faec6e96ce419714f
SHA256111e35aab5fac34c9af1f835c95328faf8a5e2b2c4bb99b9a66eb0b6fccfabc3
SHA51298475d63c919266be296ce62a52e19a55705512a62cd79c0f234b6f9986c6af66b2e9ba6de1927965280306b70d40163a53cae7b95846e69f503d66d895010f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564e9970f35ba3ad068cd7e376fec1eae
SHA109f1a78a54d8000436f89b4da7bd69ffd3e20ef5
SHA2569ae592a4dbfd0021c2ea471b6857318ec27d62d9cbdaa0310105789308947782
SHA512b4694435107ee919a30bcc26741cc6a9594acf959cb5aa30d206fb48f958f333cd5ecf9fffb8caaa4975731fac6428238005c6e2f38325594d43d398ebf1c5bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568ccdbdee2dd49d66aa479a53dc9671d
SHA1f584fca110b7348d7ebdff306e40eb5f4012dc24
SHA256c4a236f89f6ba11066e8bb9d429534636de94f79b69f824432815bccddd62cf1
SHA5125d3a36dc4bd2f3e3aa1ac0a69b17306376d9455e966f6494ccb0c90939cd0257257cbec213fea79a621ff73cb4a803828494899a996d3086fdf76a2860a64f9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d1d00d9d90a65000cccb0aabed8f720
SHA1efd8bd69e1990595da328088618c84e1eb71258d
SHA256edc5256c582514f9595526e61caaeb36204045282e60225df03736102d7fe5cf
SHA5126b812db5f69807b124019a1410518e3f354a45c934ab4ea3527de8f8b445f09e0a2c29b23b43a8f9c86ed84b24dc9c2efd60a0479e8aa26e92d5fd704e61a8cb
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a